LSASS memory dump via Windows Error Reporting

Adversaries may abuse Windows Error Reporting service to dump LSASS memory. The ALPC protocol can send a message to report an exception on LSASS and consequently cause WER to dump the memory of the LSASS process.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Acceso a credenciales
• Técnicas MITRE: T1003, T1003.001

Volver a todas las reglas