Listen to this Post
Introduction
Credential theft remains a top attack vector in cybersecurity, with adversaries constantly evolving techniques to bypass defenses. Doppelganger, an advanced LSASS (Local Security Authority Subsystem Service) dumper, introduces process cloning to evade detection, making it a formidable tool for red teams—and a critical threat for blue teams to understand.
Learning Objectives
- Understand how Doppelganger leverages process cloning to bypass security controls.
- Learn defensive techniques to detect and mitigate LSASS dumping attacks.
- Explore command-line tools to analyze and hardend LSASS memory access.
- How Doppelganger Works: Process Cloning & LSASS Dumping
Doppelganger clones LSASS into a new process, allowing credential extraction without direct interaction with the original process.
Command (Windows – Manual Dump with Task Manager)
tasklist /svc | findstr lsass.exe Identify LSASS PID procdump.exe -ma <PID> lsass.dmp Dump LSASS memory (Sysinternals)
Steps:
1. Locate LSASS’s PID using `tasklist`.
- Use ProcDump (Microsoft’s Sysinternals) to create a memory dump.
3. Offline analysis with Mimikatz or Pypykatz.
2. Detecting Doppelganger: Sysmon & Event Logs
Sysmon Configuration (XML Snippet)
<RuleGroup name="LSASS Access Monitoring"> <ProcessAccess onmatch="include"> <TargetImage condition="contains">lsass.exe</TargetImage> </ProcessAccess> </RuleGroup>
Steps:
- Deploy Sysmon with this rule to log LSASS access attempts.
- Alert on unexpected processes (e.g., `explorer.exe` accessing LSASS).
3. Mitigation: Disabling LSASS Credential Storage
Windows Hardening (Group Policy)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" /v UseLogonCredential /t REG_DWORD /d 0 /f
Steps:
- Disable WDigest to prevent plaintext credentials in memory.
- Enable Credential Guard (
gpedit.msc→ Windows Defender Credential Guard).
4. Red Team Alternative: Custom LSASS Cloning
C++ Snippet (Process Hollowing)
HANDLE hProcess = CreateProcessA("lsass.exe", ..., CREATE_SUSPENDED, ...);
NtUnmapViewOfSection(hProcess, baseAddr);
WriteProcessMemory(hProcess, newAddr, payload, size, NULL);
ResumeThread(hProcess);
Steps:
- Suspend LSASS, inject malicious code via process hollowing.
2. Extract credentials from the cloned process.
- Blue Team Forensics: Volatility & Memory Analysis
Volatility Command (Linux)
vol.py -f lsass.dmp windows.pslist | grep -i lsass vol.py --profile=Win10x64 -f lsass.dmp mimikatz
Steps:
1. Use Volatility to detect LSASS manipulation.
2. Hunt for unusual DLLs or thread injections.
What Undercode Say
- Key Takeaway 1: Doppelganger’s process cloning makes it stealthier than traditional LSASS dumpers.
- Key Takeaway 2: Defenders must monitor process ancestry (e.g., `svchost.exe` spawning LSASS clones).
Analysis:
While Doppelganger raises the bar for credential theft, memory access hardening and behavioral analytics (e.g., CrowdStrike, SentinelOne) can detect cloned process anomalies. Expect EDR bypasses to evolve, requiring deeper kernel-level telemetry.
Prediction
By 2025, 50% of credential theft attacks will use process cloning or kernel-mode bypasses, forcing a shift toward hardware-based isolation (e.g., Microsoft Pluton). Proactive LSASS hardening and threat hunting will be non-negotiable.
References:
IT/Security Reporter URL:
Reported By: Florian Hansemann – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
