Challenge 13: LSASS Without Keywords

Medium Process Monitoring Bypass Target: Rule 4

Objective

Interact with the LSASS process without including “lsass” in your command line arguments.

Scanner Behavior

Rule 4 requires two conditions to trigger: the tool name must match AND the command line must contain “lsass” or “-ma”:

for tool in LsassDumpIndicators:
  if tool in nameLower or tool in cmdLower:
    if "lsass" in cmdLower or "-ma" in cmdLower:  # BOTH needed!
      ...

Rules

Reference or interact with the LSASS process
The command line must not contain the string “lsass”
The EDR must not trigger a LSASS_DUMP detection

Hints

Hint 1

You can reference LSASS by its PID instead of its name. tasklist | findstr lsass gives you the PID (the EDR might catch "lsass" in Rule 2 though).

Hint 2

procdump -ma 612 (where 612 is the LSASS PID) - no "lsass" string in the command line!

Hint 3

Even better: use the PID AND rename the tool (Challenge 14) to bypass both conditions of Rule 4.