Skip to content
Threat Feed

Tag

Duplicatehandle

1 brief RSS
medium advisory

Potential Credential Access via LSASS Handle Duplication

Detection of suspicious LSASS handle access via DuplicateHandle from an unknown call trace module, indicating a potential attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access.

Windows credential-access lsass duplicatehandle mirrordump
2r 1t