ColdWer

A cold war on your endpoint. 🥶 ColdWer ColdWer leverages WerFaultSecure.exe PPL bypass to freeze EDR/AV processes and dump LSASS memory on modern Windows systems. C O L D W E R └─┴─┴── WerFaultSecure └─┴──────── LSASS Dump └─┴──────────── Cold Freeze Freeze your EDR/AV. Extract what you need. Sta...

NativeDump

NativeDump NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz SystemInfo, ModuleList and Memory64List Streams. NTOpenProcessToken and NtAdjustPrivilegeToken to get the...

MalSeclogon

MalSeclogon A little tool to play with the Seclogon service. Full technical details at: https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html Usage MalSeclogon v0.2 @splintercode Args: -p Pid of the...

POSTDump

POSTDump Another tool to perform minidump of LSASS process using few technics to avoid detection. POSTDump is the C / .NET implementation of the ReactOS minidump function like nanodump, thus avoiding call to the Windows API MiniDumpWriteDump function. The dump logic code is saved under the...

MultiDump

MultiDump MultiDump is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly, without triggering Defender alerts, with a handler written in Python. Blog post: https://xreous.io/posts/multidump MultiDump supports LSASS dump via ProcDump.exe or comsvc.dll, it offe...

redsnarf

. \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers...

veneficus

@abraxasnull · [email protected] · abraxaslabs.tech · github.com/abraxas/veneficus クレジット: @YoSoth0 Veneficus Mini v3.0 Windows 10/11 x64 インプラントキット: PowerShell ステージャー 、Rust PE 、そして Telegram でオペレーターに通知する Cloudflare Worker 。 ステージャー resources/loader.ps1 は、現在の PowerShell プロセスで AMSI を無効化し、Worker の...

createdump

Windows App LSASS ダンプ - 概念実証 このプロジェクトは、カスタムフックを利用して LSASS へのプロセスアクセスを有効にし、Windows App から取得した Microsoft 署名済み実行可能ファイルである createdump.exe ツールを使用して LSASS プロセスをダンプする方法を示しています。 Get-AuthentiCodeSignature -FilePath Join-Path -Path Get-AppxPackage -Name Windows365.InstallLocation -ChildPath...

PPLBlade - Protected Process Dumper Tool

Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3. Uploading...