🎯 LSASS memory dumping

The items that name it 3

• Fantastic clear-text passwords and where to collect them (Part 2 - Windows)
  writeup2026-06-28

  Traditional method of obtaining cleartext/hashed passwords from the LSASS process; noted as noisy and often flagged 'Detected' but not 'Blocked' by EDR.

• Komari Red: The Monitoring Tool with a Built-in Reverse Shell
  writeup2026-04-30It is written here as LSASS Memory dumping (comsvcs.dll minidump).

  Demonstrated via Komari Remote Exec panel dispatching Invoke-AtomicTest T1003.001-TestNumbers 2 (comsvcs.dll LSASS minidump) against an internal test VM

• Evading command-line detection with doskey
  writeup2022-10-22

  A doskey macro (test2) downloads Procdump and runs 'procdump.exe -accepteula -ma lsass.exe lsass.dmp' to dump LSASS process memory for credential extraction, executed without powershell.exe visibly appearing on the command line