In this blog post I’ll outline four incident response playbooks for MITRE ATT&CK Technique T1003: OS Credential Dumping. Credential Dumping…

Credential dumping is a common post-exploitation technique used by attackers to harvest user credentials from a compromised system. By…

NativeDump is a new tool for stealthy LSASS process dumping using only NTAPIs, bypassing EDRs to extract credentials for tools like Mimikatz or Pypykatz.

Symantec exposed a Russian-aligned espionage campaign in Ukraine using LotL tactics. Attackers used a Sandworm-linked webshell (Localolive) and abused scheduled tasks to dump credentials and bypass Windows Defender.

DumpGuard, a new tool, exploits the Remote Credential Guard protocol to steal NTLMv1 hashes from modern Windows systems, even when Credential Guard is active.

DumpGuard BOF Beacon Object File (BOF) port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. This repository contains a Beacon Object File (BOF) implementation of…

At a glance Malware family GoSerpent backdoor, plus McMx, Stowaway, ThumbcacheService, and TmcLoader/TmcPayload Threat actor Unconfirmed. Kaspersky notes a possible link to TetrisPhantom. Target /…