A memory dump of lsass with a Windows DLL

Separate routine lsass access from a credential dump. Read Sysmon event 10 access masks and call traces, then tie the dump to its command line and output file.

Terminal mission
Advanced
4 objectives
0 of 4 solved

Briefing

lsass.exe holds credentials for everyone logged on to a machine. Reading its memory is how most credential theft tools work. Sysmon event 10 logs process access with the requested rights (GrantedAccess) and a CallTrace of the DLLs involved.

Antivirus and Windows services open lsass with limited rights such as 0x1000 (query limited information) all day. You have JUMP-02’s Sysmon log.

PowerShell · JUMP-02

JUMP-02 · Sysmon triage

Type help for the command list and objectives for your tasks. Everything runs in this browser.

PS /Users/analyst>

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.