
CLR-Unhook
Modern security products (CrowdStrike, Bitdefender, SentinelOne, etc.) hook the nLoadImage function inside clr.dll to intercept and scan in-memory…
defensive-toolsexploitationpayload-development+3
217

Modern security products (CrowdStrike, Bitdefender, SentinelOne, etc.) hook the nLoadImage function inside clr.dll to intercept and scan in-memory…

Hook PasswordChangeNotify

Leverage WindowsApp createdump tool to obtain an lsass dump

exp for CVE-2019-0887