LSASS memory dump via Windows Error Reporting
Adversaries may abuse Windows Error Reporting service to dump LSASS memory. The ALPC protocol can send a message to report an exception on LSASS and consequently cause WER to dump the memory of the LSASS process.
- Platform: Windows
- Severity: High
- MITRE Tactic: Credential Access
- MITRE Techniques: T1003, T1003.001