name: LSASS memory dump preparation via SilentProcessExit
id: d325e426-f89a-4f7c-b655-3874dad07986
version: 1.0.0
description: |
  Adversaries may exploit the SilentProcessExit debugging technique to conduct
  LSASS memory dump via WerFault.exe (Windows Error Reporting) binary by creating
  specific registry keys/values.
  WerFault.exe is a process known for dumping every crashing process. Attackers may
  exploit the WER service to evade defense mechanisms.
  This method relies on a mechanism introduced in Windows 7 called Silent Process Exit,
  which provides the ability to trigger specific actions for a monitored process
  either when process terminates itself by calling ExitProcess(), or another process
  terminates it via the TerminateProcess() API.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1003
  technique.name: OS Credential Dumping
  technique.ref: https://attack.mitre.org/techniques/T1003/
  subtechnique.id: T1003.001
  subtechnique.name: LSASS Memory
  subtechnique.ref: https://attack.mitre.org/techniques/T1003/001/
references:
  - https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2

condition: >
  modify_registry
    and
  registry.key.name
    imatches
  'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass*'

min-engine-version: 2.0.0
