Ghost in the PPL – LSASS Memory Dump

Original text by Clément Labro

The article explores techniques for extracting memory from the LSASS (Local Security Authority Subsystem Service) process when it runs as a Protected Process Light (PPL). Modern versions of Windows use PPL to protect sensitive processes such as LSASS from tampering or credential dumping by user-mode tools.

The research initially aimed…

https://core-jmp.org/2026/03/ghost-in-the-ppl-lsass-memory-dump/