OnyxC2 LSASS memory dumping via PROCESS_VM_READ and MiniDumpWriteDump from unsigned process

Duo Tech@duotech

•updated Aug 14, 2026•2•0•4

Detects LSASS memory access via PROCESS_VM_READ combined with MiniDumpWriteDump-style API usage from an unsigned or untrusted process, correlated with a nearby dump-file creation, consistent with OnyxC2's premium-tier credential dumping.