Suspicious Process Access to LSASS Memory via Dbgcore/Dbghelp

Security research identifies that legitimate Windows debugging DLLs, specifically dbgcore.dll and dbghelp.dll, are frequently abused by offensive tools to facilitate credential dumping from the Local Security Authority Subsystem Service (LSASS). The MiniDumpWriteDump function, while intended for troubleshooting, allows attackers to create memory dumps of processes including LSASS. Tools executing from unconventional locations often leverage these libraries to bypass basic detection mechanisms.

Impact

Successful abuse of these libraries allows for the acquisition of LSASS process memory, which can be parsed offline to extract credentials, hashes, and cleartext passwords, leading to account takeover and lateral movement.

Recommendation

• Implement the provided detection rule for LSASS process access initiated from non-standard directories.
• Baseline administrative or debugging tools in the environment that legitimately access LSASS using these DLLs to minimize false positives.
• Review and restrict write/execute permissions in user-accessible directories like C:\Users\Public\ and C:\Windows\Temp\ to impede the execution of credential dumping utilities.