Threat Hunt: Detecting LSASS Memory Dump via ProcDump

March 6, 2024

Monitoring for the misuse of diagnostic tools like ProcDump for dumping sensitive processes such as LSASS is a critical component of ……

Oops! It looks like the content you're trying to access is exclusively available to our amazing Patreon supporters. Your support fuels our website and helps us keep our automation humming. Not only will you unlock a world of exclusive content starting from just $1/£1, but you'll also help keep our site running smoothly. Some of our content is tier-specific, ensuring our patrons get the value they deserve for their support. Join us today and be part of our thriving community!

To view this content, you must be a member of RedPacketSecurity's Patreon

Unlock with Patreon

Already a qualifying Patreon member? Refresh to access this content.

Threat Hunt: Detecting LSASS Memory Dump via ProcDump

[HUNTERS] – Ransomware Victim: Amourgis & Associates

[HUNTERS] – Ransomware Victim: Dietzgen Corporation

Cobalt Strike Beacon Detected – 156[.]238[.]227[.]43:80

Cobalt Strike Beacon Detected – 8[.]134[.]166[.]14:443

Cobalt Strike Beacon Detected – 123[.]57[.]209[.]214:1234

You may have missed

[HUNTERS] – Ransomware Victim: Amourgis & Associates

[HUNTERS] – Ransomware Victim: Dietzgen Corporation

Cobalt Strike Beacon Detected – 156[.]238[.]227[.]43:80

Cobalt Strike Beacon Detected – 8[.]134[.]166[.]14:443

Cobalt Strike Beacon Detected – 123[.]57[.]209[.]214:1234