Efsui.exe Efs Installdra Patched Direct

[Normal Execution Path] C:\Windows\System32\lsass.exe ---> C:\Windows\System32\efsui.exe /efs /installdra (Legitimate DRA Deployment) [Suspicious Execution Path] C:\Users\Public\Malicious.exe ---> C:\Windows\System32\efsui.exe /encryptmydocs (Potential Rogue EFS Attack) 1. EFS-Based Ransomware Attacks

A is a special EFS certificate that can decrypt any EFS-encrypted file within a domain or on a machine, used for recovery when a user loses their private key. efsui.exe efs installdra

Where DRACertificate.pfx contains a valid EFS DRA private key. [Normal Execution Path] C:\Windows\System32\lsass

EFS UI Application