search

BishopFox / sliver

Adversary Emulation Framework
GNU General Public License v3.0
8.4k stars 1.11k forks source link

Physical Memory Dump #44

Open moloch-- opened 5 years ago

moloch-- commented 5 years ago

Integrate a physical memory dumping tool to avoid having to open a process handle to lsass.exe when acquiring mimikatz-able memory dumps.

https://zeltser.com/memory-acquisition-with-dumpit-for-dfir-2/

rkervella commented 5 years ago

Or even better: mount it remotely as a file system: https://github.com/ufrisk/MemProcFS (not sure what we'd need to adapt though)

moloch-- commented 5 years ago

I wonder if we can just point Volatility's Mimikatz plugin directly at MemProcFS?

rkervella commented 5 years ago

Almost sure you can: I've seen the author demo a remote volatility with this, before he split PCILeech into multiple projects.

moloch-- commented 5 years ago

https://github.com/ufrisk/MemProcFS-plugins - Haha, there's already a plugin to do it