Potential Credential Dumping via LSASS SilentProcessExit Technique
This rule detects modifications to the Windows Registry related to the SilentProcessExit mechanism for the lsass.exe process. Specifically, it looks for changes in the registry key path 'microsoft\windows nt\currentversion\silentprocessexit\lsass.exe'. This technique can be abused by adversaries to configure a monitor program to dump the memory of the lsass.exe process, which often contains sensitive credential information.
YARA-L
