LSASS memory dump preparation via SilentProcessExit
Adversaries may exploit the SilentProcessExit debugging technique to conduct LSASS memory dump via WerFault.exe (Windows Error Reporting) binary by creating specific registry keys/values. WerFault.exe is a process known for dumping every crashing process. Attackers may exploit the WER service to evade defense mechanisms. This method relies on a mechanism introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger specific actions for a monitored process either when process terminates itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Acceso a credenciales
- Técnicas MITRE: T1003, T1003.001