Potential Credential Dumping Via LSASS SilentProcessExit Technique

Title: Potential Credential Dumping Via LSASS SilentProcessExit Technique
Status: test
Description:Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
References:
  -https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
  -https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
Author: Florian Roth (Nextron Systems)
Date: 2021-02-26
modified:2022-12-19
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection:
    TargetObject|contains: 'Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe'
  condition:selection
Falsepositives:
  -Unlikely
Level: critical