mirror of
https://github.com/deepinstinct/LsassSilentProcessExit
synced 2026-06-21 13:48:59 +00:00
SecurityResearchDeepInstinct
420 B
420 B
LsassSilentProcessExit
New method of causing WerFault.exe to dump lsass.exe process memory to disk for credentials extraction via silent process exit mechanism without crasing lsass.exe.
Usage:
LsassSilentProcessExit.exe <PID of LSASS.exe> <DumpMode>
Where DumpMode can be:
0 - Call RtlSilentProcessExit on LSASS process handle
1 - Call CreateRemoteThread on RtlSilentProcessExit on LSASS