One Day Sec

What are the different dump methods supported by Lsassy for remotely extracting the lsass process?

Lsassy supports a variety of dump methods to handle different environments and protections. These include: `comsvcs` (using `MiniDump()` from `comsvcs.dll`), `comsvcs_stealth` (copies the dll to temp before use), `dllinject` (DLL injection via APC), `dumpert` and `dumpertdll` (using Outflank's Dumpert tool via API `MiniDumpWriteDump()`), `edrsandblast` (signed driver technique), `mirrordump` and `mirrordump_embedded` (via LSA SSP plugin), `nanodump` (multiple handle leak methods), `ppldump` (bypasses PPL protection on Windows 10/Server 2019), `procdump`, `rdrleakdiag`, and `wer`. Each method may require specific parameters like paths to executables or DLLs, and some leave traces that need manual cleanup.
dump methodscomsvcsdllinjectdumpertmirrordumpnanodumpppldumplsass dump

Browse all Q&A →