Field Notes: Reconstructing the Attacker's LSASS Dump

What it is

Field notes from DFIR.ch on an incident involving Ricardo J. Ruiz's TrickDump, a credential-dumping tool that avoids writing a conventional LSASS minidump to disk.

How it works

TrickDump splits the dump into three stages, which can run as separate executables: Lock collects OS version info via RtlGetVersion; Shock enables SeDebugPrivilege, locates LSASS, and gathers process/module info via NtGetNextProcess, NtQueryInformationProcess, and NtReadVirtualMemory; Barrel enables SeDebugPrivilege and walks LSASS's virtual address space, dumping committed memory regions not marked PAGE_NOACCESS via NtQueryVirtualMemory/NtReadVirtualMemory. Output is lock.json, shock.json, barrel.json plus a ZIP of hundreds of randomly-named files, each a raw memory-region chunk — barrel.json maps each chunk filename to its virtual address and size. TrickDump also supports .text-section overwriting of ntdll.dll (disk, knowndlls, debugproc techniques) to bypass user-mode API hooks.

flowchart LR
    A[Lock: OS info] --> B[Shock: handle + modules]
    B --> C[Barrel: dump memory regions]
    C --> D[lock/shock/barrel.json + ZIP]
    D -->|create_dump.py| E[recovered.dmp]
    E -->|pypykatz| F[Extracted credentials]

Preconditions / Affected

TrickDump does not work against LSASS protected by Protected Process Light (PPL) — this is stated as an important limitation.

What to do

To reconstruct and validate what an attacker actually recovered (rather than stopping at "LSASS was touched"), the author ran TrickDump's own reconstruction script on the recovered artifacts:

python3 create_dump.py \
    -l trick/lock.json \
    -s trick/shock.json \
    -b trick/barrel.json \
    -z trick/trick.zip \
    -o recovered.dmp

then parsed the result with pypykatz lsa minidump recovered.dmp. In this incident that confirmed reusable Kerberos credential material was actually recoverable for a specific account.

Hunting guidance given:

• Look for lock.json, shock.json, barrel.json plus a ZIP of many randomly-named chunk files (default name barrel.zip) in staging directories.
• Monitor for unexpected processes obtaining LSASS handles with memory-read rights (Sysmon EID 10 / EDR process-access telemetry).
• Watch for up to three binaries in the same working directory, with Shock and Barrel accessing LSASS in close temporal proximity (Lock may be absent; an all-in-one "Trick" variant collapses the workflow into one process).
• Where telemetry allows, chain: SeDebugPrivilege enablement → extensive LSASS memory reads → creation of a ZIP with many memory-region entries.

Caveats

File-based detections relying on a recognizable lsass.dmp will miss this technique entirely since no conventional dump file is written on the victim host; the reconstruction step requires running create_dump.py offline on the recovered artifacts.