Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 689246">I am not sure why, I was thinking this too when I read this thread today. I know you can enable it as a protected process on modern versions of Windows... Maybe it isn&#039;t protected by default because it is harder to abuse by default (for example it is under SYSTEM therefore without a zero-day RCE exploit you cannot inject code into it unless you&#039;re elevated and have debugging rights anyway). And malware with admin rights doesn&#039;t need to care for lsass.exe, it can do other things. That could be the reason why...Csrss.exe is a protected process now though and same circumstance as the above, interesting.You can reverse csrss.exe, lsass.exe and their exclusive modules in IDA to learn more about it. You can get the debugging symbols (IDA should do it automatically by connecting and retrieving for you) so you&#039;ll be able to see the function names properly and the such. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Deleted member 65228, post: 689246"] I am not sure why, I was thinking this too when I read this thread today. I know you can enable it as a protected process on modern versions of Windows... Maybe it isn't protected by default because it is harder to abuse by default (for example it is under SYSTEM therefore without a zero-day RCE exploit you cannot inject code into it unless you're elevated and have debugging rights anyway). And malware with admin rights doesn't need to care for lsass.exe, it can do other things. That could be the reason why... Csrss.exe is a protected process now though and same circumstance as the above, interesting. You can reverse csrss.exe, lsass.exe and their exclusive modules in IDA to learn more about it. You can get the debugging symbols (IDA should do it automatically by connecting and retrieving for you) so you'll be able to see the function names properly and the such. :) [/QUOTE]

Verification