LSASS memory dump preparation via SilentProcessExit
Adversaries may exploit the SilentProcessExit debugging technique to conduct LSASS memory dump via WerFault.exe (Windows Error Reporting) binary by creating specific registry keys/values. WerFault.exe is a process known for dumping every crashing process. Attackers may exploit the WER service to evade defense mechanisms. This method relies on a mechanism introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger specific actions for a monitored process either when process terminates itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API.
- Platform: Windows
- Severity: High
- MITRE Tactic: Credential Access
- MITRE Techniques: T1003, T1003.001