huntrule

Windows Registry: SilentProcessExit lsass.exe Monitor Registration for Credential Dumping

Alerts on registry registrations for SilentProcessExit monitoring of lsass.exe, a potential precursor to credential dumping.

FreeUnreviewedSigmacriticalv1
title: "Windows Registry: SilentProcessExit lsass.exe Monitor Registration for Credential Dumping"
id: 9109b71b-2ca1-42fd-a222-8e73a2236a36
related:
  - id: 36803969-5421-41ec-b92f-8500f79c23b0
    type: similar
  - id: 55e29995-75e7-451a-bef0-6225e2f13597
    type: derived
status: test
description: This rule identifies registry changes that register a monitor for silent process exit of lsass.exe under the SilentProcessExit key path. Attackers can use this technique to trigger actions on lsass.exe termination that may support memory dumping and credential access. It relies on Windows registry event telemetry matching TargetObject paths containing Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe.
references:
  - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
  - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_silentprocessexit_lsass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-02-26
modified: 2022-12-19
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1

What it detects

This rule identifies registry changes that register a monitor for silent process exit of lsass.exe under the SilentProcessExit key path. Attackers can use this technique to trigger actions on lsass.exe termination that may support memory dumping and credential access. It relies on Windows registry event telemetry matching TargetObject paths containing Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.