Skip to content
Threat Feed
Subscribe

Product

Windows Sysinternals ProcDump

1 brief RSS
high advisory

Detecting Renamed ProcDump Execution for Evasion

This brief focuses on the detection of renamed Sysinternals ProcDump executables, a technique often employed by threat actors to evade security controls and perform credential dumping from LSASS memory on Windows systems, leading to potential lateral movement and privilege escalation.

Windows Sysinternals ProcDump stealth credential-dumping sysinternals evasion windows
1r 2t