application_error | Detection.FYI

LSASS Process Crashed - Application

Dec 24, 2025 · attack.credential-access attack.t1003.001 ·
Share on:

Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.

Read More
Microsoft Malware Protection Engine Crash

Dec 24, 2025 · attack.defense-evasion attack.t1211 attack.t1562.001 ·
Share on:

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Read More