Jump to content
biosh

LSASS dump using Transactional NTFS (TxF) via SMB

Recommended Posts

Posted

Dragut, TxF nu e "readable" in general de catre AV/EDR? Bine, stiu ca scrisul pe disc e doar o parte a problemei, problema e accesul in memorie la LSASS (PS: iei pid la runtime in loc sa il ceri sa fie scris, iterezi printre procese si iei dupa nume :D ) dar oricum e utila ideea.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...