Dump LSASS process memory on Windows x64 using direct syscalls.
npx skills add https://github.com/AeonDave/malskill --skill nanodump
Please help me install this Agent Skill. Skill: nanodump Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/windows/nanodump Command: npx skills add https://github.com/AeonDave/malskill --skill nanodump
This Skill provides a stealthy method to dump LSASS memory on Windows systems, crucial for extracting credentials without triggering security alerts.
Execute nanodump.exe with the --fork and --write flags to create a stealthy LSASS memory dump to a specified file path.
High-intent search queries and answers about installing and using this skill.
Dump LSASS memory stealthily using direct syscalls, handle duplication, and fork-based techniques to bypass EDR and AV solutions. You can then parse the resulting minidump offline to extract NTLM hashes and Kerberos tickets.
Evading AV solutions when dumping LSASS on Windows x64 is achieved through direct syscalls and handle duplication. These techniques avoid standard API hooks, allowing stealthy memory extraction without triggering security alerts.
Yes, you can use Mimikatz or pypykatz to parse the LSASS minidump generated by nanodump. The Skill facilitates credential extraction by outputting a minidump file for offline analysis to recover NTLM hashes and Kerberos tickets.
You need Visual Studio to compile the LSASS memory dumper from source, but precompiled formats are also available. You can deploy the EXE, BOF, or reflective DLL formats directly without compiling if preferred.
To execute a stealthy LSASS dump using a fork-based technique, run the executable with the --fork and --write flags. This creates a stealthy memory dump to a specified file path for further credential analysis.
vzcoInject ARC Probe into a running Windows x64 process via TCP port 9998.
dreadnodeRecover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.
gerald-icaEnumerate Microsoft Active Directory domains and execute Kerberos attacks.
balsm-healthDetect credential dumping techniques in Sysmon and Windows Security logs.
