prox0959/memguardZero-dependency Windows EDR utility that detects and mitigates unauthorized LSASS memory access, handle duplication, and LOLBin credential dumping in real time.
-0078D6.svg?logo=windows&logoColor=white){kind=icon}
-brightgreen.svg){kind=icon}
A lightweight, zero-dependency Windows EDR utility that detects and mitigates unauthorized LSASS memory access, handle duplication, and LOLBin credential dumping attempts in real time.
In Windows enterprise environments, the Local Security Authority Subsystem Service (lsass.exe) stores active user credentials, Kerberos ticket-granting tickets (TGT), and NTLM password hashes in its virtual memory.
Because LSASS holds the keys to the entire domain, adversaries and red teams routinely target it using:
PROCESS_VM_READ (0x0010) or PROCESS_ALL_ACCESS (0x1FFFFF).rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass_pid> <dump_path> full or procdump.exe -ma lsass.exe.Commercial Endpoint Detection and Response (EDR) platforms like CrowdStrike Falcon or SentinelOne charge thousands of dollars in enterprise subscriptions to protect against this exact technique (MITRE ATT&CK T1003.001).
MemGuard provides a completely free, open-source, and transparent Python implementation using native Windows Win32 and NT kernel structures with zero third-party dependencies.
flowchart TD
subgraph Host ["Windows 11 / 10 Endpoint"]
Adversary["Attacker / LOLBin / Mimikatz / ProcDump"] -- OpenProcess (PROCESS_VM_READ) --> LSASS["lsass.exe (PID: 1744)"]
subgraph MemGuard ["MemGuard Defensive Engine"]
HScan["NtQuerySystemInformation\n(SystemExtendedHandleInformation)"] --> CheckMask{"Access Mask\nAnalysis"}
CheckMask -- "VM_READ / ALL_ACCESS" --> Alert1["🚨 Critical Alert:\nUnauthorized Handle"]
PEBScan["Process PEB Reader\n(NtQueryInformationProcess)"] --> LOLBinCheck{"CommandLine\nRegex Engine"}
LOLBinCheck -- "comsvcs.dll / procdump" --> Alert2["🚨 Critical Alert:\nLOLBin Dump Attempt"]
DumpWatch["Triage Directory\nArtifact Scanner"] --> MDMPCheck{"MDMP Header\nValidation"}
MDMPCheck -- "Valid LSASS .dmp" --> Alert3["🚨 Alert:\nRogue Dump File"]
Alert1 & Alert2 --> Mitigation["Active Mitigation:\nNtSuspendProcess (Freeze)"]
end
endQueries NtQuerySystemInformation with SystemExtendedHandleInformation (class 64) to enumerate every open handle across the entire operating system. It duplicates process handles and verifies if their target resolves to the active lsass.exe PID.
Analyzes the 32-bit GrantedAccess bitmask of each handle holder:
PROCESS_VM_READ (0x0010): CRITICAL (Read process memory — prerequisites for credential dumping)PROCESS_VM_WRITE (0x0020): HIGH (Memory injection / shellcode)PROCESS_VM_OPERATION (0x0008): HIGH (VirtualAllocEx / page protection modification)PROCESS_CREATE_THREAD (0x0002): HIGH (Remote thread creation)PROCESS_ALL_ACCESS (0x1FFFFF): CRITICAL (Unrestricted control)Known legitimate Windows system processes (services.exe, csrss.exe, wininit.exe, Windows Defender MsMpEng.exe) are whitelisted, while unverified third-party processes holding dump-capable handles are immediately flagged.
Inspects running processes by reading the Process Environment Block (PEB) directly from virtual memory via NtQueryInformationProcess(ProcessBasicInformation) and ReadProcessMemory:
PEB -> ProcessParameters -> CommandLine (UNICODE_STRING).comsvcs.dll, #24, MiniDumpWriteDump, procdump -ma).NtSuspendProcess)When run with the --suspend flag, MemGuard freezes the offending process's threads in place using native ntdll.NtSuspendProcess, preventing memory extraction while preserving the attacker process in RAM for live forensic analysis.
No pip installation needed! Clone and run directly with Python 3.8+:
git clone https://github.com/prox0959/MemGuard.git
cd MemGuard
python memguard.py --scan
# Monitor system every 3 seconds
python memguard.py --monitor --interval 3
# Monitor with automatic active mitigation (freeze dumper processes)
python memguard.py --monitor --interval 2 --suspend
python memguard.py --scan --json incident_report.json
python memguard.py --scan --lang tr
███╗ ███╗███████╗███╗ ███╗ ██████╗ ██╗ ██╗ █████╗ ██████╗ ██████╗
████╗ ████║██╔════╝████╗ ████║██╔════╝ ██║ ██║██╔══██╗██╔══██╗██╔══██╗
██╔████╔██║█████╗ ██╔████╔██║██║ ███╗██║ ██║███████║██████╔╝██║ ██║
██║╚██╔╝██║██╔══╝ ██║╚██╔╝██║██║ ██║██║ ██║██╔══██║██╔══██╗██║ ██║
██║ ╚═╝ ██║███████╗██║ ╚═╝ ██║╚██████╔╝╚██████╔╝██║ ██║██║ ██║██████╔╝
╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝
Zero-Dependency LSASS Memory Dump Shield & EDR Hook Detector | Pure Python
► MITRE ATT&CK: T1003.001 (OS Credential Dumping: LSASS Memory)
[*] Privilege Level: Elevated (Administrator) - Full Kernel Handle Access
[*] SeDebugPrivilege Status: Enabled Successfully
[*] Target Security Process Found: lsass.exe (PID: 1744) | Path: C:\Windows\System32\lsass.exe
--- LSASS Handle Table Audit (NtQuerySystemInformation) ---
✓ No unauthorized or suspicious handles targeting LSASS detected.
--- Process Heuristics & LOLBin CommandLine Inspection ---
✓ No credential dumping processes or LOLBin signatures found.
--- Dump File Artifacts & Honeypot Tripwire ---
✓ No rogue memory dump (.dmp) files identified in triage directories.
Audit Summary: 0 handle threats, 0 process threats, 0 dump artifacts.
MemGuard/
├── memguard.py # Main CLI entry point & real-time monitoring loop
├── core/
│ ├── __init__.py
│ ├── win_api.py # Native Win32/NT kernel ctypes prototypes & PEB reader
│ ├── handle_scanner.py # NtQuerySystemInformation handle table & access mask auditor
│ ├── process_auditor.py # Heuristic LOLBin cmdline inspection & parent verification
│ └── honey_dmp.py # MiniDump (.dmp) artifact validator
├── LICENSE # MIT License
├── README.md # Technical Documentation
└── requirements.txt # Zero dependencies notice
Developed by Çınar (@prox0959)
High school student researching low-level operating system internals, defensive security, and Windows memory forensics.
Distributed under the MIT License.