Hiding malware in Windows – The basics of code injection

[In2an3_PpG]

Note, since Windows 8.1 you can optionally opt-in to make lsass.exe a protected process. This is a really good idea by the way because lsass.exe has been attacked before for credential theft.

Configuring Additional LSA Protection

I recommend to everyone to do this but only if you understand how it works to prevent potential problems.

It should be mentioned that to attack lsass.exe normally, you'd need to be running with elevation anyway... and thus if you had administrator rights, you could always forcefully disable the protection via registry modification, but it is unlikely this would happen in the real world anyway. I've never seen a malware sample actually do this in the wild yet.

I configured the additional protection following the registry key.

Interesting article, the author used mimikatz in a test against LSA protection and Credential Guard.

Poking Around With 2 lsass Protection Options – Red Teaming with a Blue Team Mentaility – Medium

 

[Eddie Morra]

Interesting article, the author used mimikatz in a test against LSA protection and Credential Guard.

The "The 0x00000005" error code being mentioned in that article is the Win32 error code for "Access Denied", it is converted to Win32 error code from NTSTATUS STATUS_ACCESS_DENIED (0xC0000022).

Basically since the lsass.exe process is now a protected process, handle acquisition is being denied system-wide. NtOpenProcess -> calls PsLookupProcessByProcessId to make sure the process exists -> then moves to Psp* if I remember correctly.

I'll have to check ntoskrnl.exe tomorrow and then I'll let you know the whole process of NtOpenProcess internally.

But basically the Windows kernel checks the opaque structures and see's that lsass.exe is actually set as a protected process so it blocks the operation and the caller is notified that the access to the process was denied.

Without that process handle, Mimikatz cannot access or modify the virtual memory of lsass.exe remotely unless it has an exploit to bypass the protection.

 

[In2an3_PpG]

The "The 0x00000005" error code being mentioned in that article is the Win32 error code for "Access Denied", it is converted to Win32 error code from NTSTATUS STATUS_ACCESS_DENIED (0xC0000022).

Basically since the lsass.exe process is now a protected process, handle acquisition is being denied system-wide. NtOpenProcess -> calls PsLookupProcessByProcessId to make sure the process exists -> then moves to Psp* if I remember correctly.

I'll have to check ntoskrnl.exe tomorrow and then I'll let you know the whole process of NtOpenProcess internally.

But basically the Windows kernel checks the opaque structures and see's that lsass.exe is actually set as a protected process so it blocks the operation and the caller is notified that the access to the process was denied.

Without that process handle, Mimikatz cannot access or modify the virtual memory of lsass.exe remotely unless it has an exploit to bypass the protection.

To learn more in regards to the lsass process, should i look towards reading about LSA Authentication?

Ex. LSA Authentication

Or is there another source? Iv been having a hard time finding much of anything other than the brief summary of what it does.

"Is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log. "

Or is this one of those undocumented scenarios with Microsoft?

 

[Eddie Morra]

Or is this one of those undocumented scenarios with Microsoft?

This.

Source and internals is all closed source so good luck finding information about the internals unless you reverse engineer it... There's lsasrv.dll as well which lsass.exe uses and it contains some functionality.

The description of lsass.exe in the speech marks is accurate though, that is spot on for what it is for.

 

[In2an3_PpG]

This.

Source and internals is all closed source so good luck finding information about the internals unless you reverse engineer it... There's lsasrv.dll as well which lsass.exe uses and it contains some functionality.

The description of lsass.exe in the speech marks is accurate though, that is spot on for what it is for.

Figures. Well now i know.