3 Sep 2025
Basic persistence is for beginners!
Master ADVANCED Windows backdoors that hide in IFEO debuggers, WMI subscriptions & SilentProcessExit hooks.
hackers-arise.com/advanced-w…
@three_cube
4
10
1,001
11 Jul 2024
40 43 74 Methods for Privilege Escalation (Linux/Windows/macOS)
github.com/HadessCS/Awesome-…
Abusing Capabities such as sudo
Objective-C library and Heimdal APIs
dylibinjection
KeychainCracker
TCC-ClickJacking
SilentProcessExit*
PW Mining in Memory
#redteam #privilegeescalation
1
66
152
7,746
5 Mar 2024
Plenty...
COM hijacks, Debugger/Verifier/SilentProcessExit in IFEO, AppCert, AppInit, netsh helpers...
1
11
1,082
7 Sep 2022
7/ Bonus Red-Team-Tip 😜: The "persistence" with the SilentProcessExit key is not shown on my host with AutoRuns.
1
7
7 Sep 2022
3/ What a great idea to use the SilentProcessExit registry key to execute a DNS request using CMD -> PowerShell! [2]
1
5
6 Sep 2021
Kevin Clark - LSASS dumper using SilentProcessExit in C# released - ShhProcessExit.cs (offensive research) #infosec #security #cybersecurity #technology gitlab.com/KevinJClark/cshar…
2
2
5 Sep 2021
@gladiatx0r Made a C# port of that SilentProcessExit lsass dumper you were talking about on @curi0usJack's stream 2 weeks ago. No more uploading to disk 🥳. Thought you might find it useful:
gitlab.com/KevinJClark/cshar…
3
42
134
9 Jun 2021
Interesting event via ProcessExitMonitor provider that captures all details for the IFEO SilentProcessExit Lsass memory dump technique (client process and target process)
deepinstinct.com/2021/02/16/…
github.com/sbousseaden/EVTX-…
1
17
68
@SBousseaden this blog may be helpful for you:hexacorn.com/blog/2019/09/19…, since WER process is used nowadays by red teamers for dumping lsass based on SilentProcessExit but I'm pretty sure there are some artifacts left by this technique like some modified registers....
2
1
6
4 Mar 2021
GitHub - deepinstinct/LsassSilentProcessExit: Command line interface to dump LSASS memory to disk via SilentProcessExit
github.com/deepinstinct/Lsas…
2
26 Feb 2021
Sigma rules to detect process memory dumping via SilentProcessExit method
Blog post
deepinstinct.com/2021/02/16/…
Old rule by @HeirhabarovT already covered the lsass*.dmp file creations
New Sigma rules
github.com/Neo23x0/sigma/pul…
1
42
130
Hexacorn | Blog SilentProcessExit – quick look under the hood hexacorn.com/blog/2019/09/19…
2
19 Sep 2019
. @hexacorn Blog: SilentProcessExit – quick look under the hood ow.ly/Y4Cz101MerZ #DFIR
2
1
9 Jul 2018
Seems my discovered persistence mechanisms (GPscript.exe, depend, silentprocessexit) is now detected in the 13.90 version of autoruns. Great job @markrussinovich
My research can be found here:
- oddvar.moe/2018/04/10/persis…
- oddvar.moe/2018/03/21/persis…
- oddvar.moe/2018/04/27/gpscri… x.com/markrussinovich/status…
2
68
142