LSASS credential dumping

Named by 3 kept items in this workspace.

Search every workspace for LSASS credential dumping. It matches the name as written, so it can find other things that share it.

The items that name it 3

The Closed Quorum: Inside the First Reported Autonomous AI C2 Implant
writeup2026-09-22
lsassDump() extracts Windows domain/local credentials from memory
Mimikatz Missing Manual
repo2026-07-31
Sigma r2026-07-01 — 20 new detection rules
repoIt is written here as LSASS Credential Dumping (various AccessMask/GrantedAccess flags).
Multiple existing rules for LSASS credential access updated with ARM64 variant coverage

All techniques in this workspace.