keyiso.dll RPC interfaces

CNG Key Isolation Service
INCryptKeyIso B25A52BF-E5DD-4F4A-AEA6-8CA7272A0E86 version 1.0
0x1B methods

• SrvRpcCreateContext
• SrvRpcReleaseContext
• SrvRpcCryptOpenStorageProvider
• SrvRpcCryptIsAlgSupported
• SrvRpcCryptEnumAlgorithms
• SrvRpcCryptEnumKeys
• SrvRpcCryptFreeBuffer
• SrvRpcCryptFreeProvider
• SrvRpcCryptFreeKey
• SrvRpcCryptOpenKey
• SrvRpcCryptCreatePersistedKey
• SrvRpcCryptGetProviderProperty
• SrvRpcCryptSetProviderProperty
• SrvRpcCryptGetKeyProperty
• SrvRpcCryptSetKeyProperty
• SrvRpcCryptFinalizeKey
• SrvRpcCryptEncrypt
• SrvRpcCryptDecrypt
• SrvRpcCryptImportKey
• SrvRpcCryptExportKey
• SrvRpcCryptSignHash
• SrvRpcCryptVerifySignature
• SrvRpcCryptDeleteKey
• SrvRpcCryptNotifyChangeKey
• SrvRpcCryptSecretAgreement - название метода доставляет
• SrvRpcCryptDeriveKey
• SrvRpcCryptFreeSecret

Имеет место на следующих endpoints:

• named pipe PIPE\protected_storage
• named pipe pipe\lsass
• ALPC Port protected_storage
• ALPC Port audit
• ALPC Port samss lpc
• ALPC Port securityevent
• ALPC Port LSARPC_ENDPOINT
• ALPC Port lsasspirpc
• ALPC Port lsapolicylookup

Как можно догадаться - все вышеперечисленные endpoints принадлежат процессу lsass.exe