Potential Credential Dumping Via LSASS SilentProcessExit Technique

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•17

Detects changes to the Windows Registry that configure a monitor program to dump the memory of the lsass.exe process using the SilentProcessExit technique. This method leverages Image File Execution Options (IFEO) to trigger a memory dump of LSASS when it exits, which can be used to extract credentials.