Abusing Windows Error Reporting to Dump LSASS Memory
Asaf Gilboa and Ron Ben-Yitzhak present a stealthy credential dumping technique that abuses native Windows Error Reporting (WER) to dump LSASS without alerts.
Summary
The Heavy EDR Surveillance Around LSASS Access
Modern Endpoint Detection and Response (EDR) agents strictly monitor `OpenProcess` and `MiniDumpWriteDump` calls targeting the Local Security Authority Subsystem Service (LSASS).
Abusing Native Windows Error Reporting (WER) Mechanisms
Asaf Gilboa and Ron Ben-Yitzhak demonstrate manipulating legitimate system crash handling daemons (WerFault.exe) to generate LSASS memory dumps on demand.
Bypassing EDR Detections Without Exploiting Vulnerabilities
Because WerFault is a trusted, digitally signed operating system binary, its memory dumping activity bypasses standard behavioral heuristics.
Detection Strategies and WER Telemetry Auditing
The authors provide blue teams with detection logic to audit WerFault command-line flags and anomalous crash dump creation events.
Related talks
Main Stage·26 min
Tarek Abdelmotaleb · Bramwell Brizendine
Tarek Abdelmotaleb and Dr. Bramwell Brizendine demonstrate weaponizing Windows syscalls into pure position-independent shellcode, evading modern EDR hooks.
Main Stage·48 min
Itzik Kotler
Comprehensive catalog of 15+ Windows process injection techniques with detection signatures and evasion analysis for each.
Adversary Village·42 min
Matthew Eidelberg
Matthew Eidelberg breaks down the mechanics of modern EDR evasion, demonstrating API unhooking, AMSI bypasses, and indirect system calls in offensive payloads.