Skip to content

Latest commit

 

History

History

SilentLsassDump

Silent Lsass Dump

Dump the LSASS process via the silent process exit mechanism into the C:\Temp directory. This implementation use direct syscall generated with @Outflanknl's InlineWhispers.

Only the first method describe in the article Lsass Memory Dumps are Stealthier than Ever Before – Part 2 has been implemented.

All credit to @deepinstinct and their LsassSilentProcessExit project.

Compile

make

Usage

Load the provided aggressor script. After you found the LSASS PID, run the command:

silentLsassDump <LSASS PID>