From 60ce4dcc7505696ca71d4f620e4e172c79735229 Mon Sep 17 00:00:00 2001 From: Sylvain Heiniger Date: Thu, 1 Jul 2021 17:02:06 +0200 Subject: [PATCH] Update README --- README.md | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 09e1238..c2e6415 100644 --- a/README.md +++ b/README.md @@ -14,9 +14,9 @@ The script causes WerFault.exe to dump lsass.exe process memory to disk for cred - 1 - Call CreateRemoteThread with RtlSilentProcessExit on LSASS ### DumpPath -- Path wherer the dumpfile shall be stored +- Path where the dumpfile shall be stored -### Demo +## Demo The following demo shows the dumping: @@ -26,6 +26,25 @@ The following demo shows the dumping: At the time of writing, we could not get the DumpMode 1 (using CreateRemoteThread) to work. +The powershell.exe process gets dumped along with lsass using the DumpMode 0, hence any pointers to get the other method working is welcome! + +## Monitoring Guidance + +The (original article)[https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/] provides some pointers on how to detect this technique. From our point of view, the following two techniques are best to detect our script being run: + +### Monitoring Registry + +Monitor the following keys for creation and modification: + +``` +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe +``` + +### Monitoring PowerShell + +The following article is a good resource: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/ + ## Authors - Ville Koch ([Twitter](https://twitter.com/vegvisir87))