
createdump
Leverage WindowsApp createdump tool to obtain an lsass dump
impersonation-toolspassword-attackspost-exploitation+1

Leverage WindowsApp createdump tool to obtain an lsass dump

Hook PasswordChangeNotify

exp for CVE-2019-0887

Modern security products (CrowdStrike, Bitdefender, SentinelOne, etc.) hook the nLoadImage function inside clr.dll to intercept and scan in-memory…