LSA Dump via SilentProcessExit

Source: github.com/elastic/protections-artifacts

Identifies the modification of the Image File Execution Options SilentProcessExit key that can be abused to dump LSASS memory via the Windows Error Reporting WerFault.exe. Adversaries may use this technique for credential access.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Rule body

[rule]
description = """
Identifies the modification of the Image File Execution Options SilentProcessExit key that can be abused to dump LSASS
memory via the Windows Error Reporting WerFault.exe. Adversaries may use this technique for credential access.
"""
id = "28969fe6-0ebe-4442-b40c-dbe9b4234f5e"
license = "Elastic License v2"
name = "LSA Dump via SilentProcessExit"
os_list = ["windows"]
reference = [
    "https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/",
]
version = "1.0.32"

query = '''
registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass*"
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"

Stages and Predicates

Stage 1: `registry`

registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass*"

Indicators

These rows show field, operator, and value matches.