Process unhooks ntdll/amsi/win32kbase before LSASS clone dump

Ankit Mehta@Secvyn

•updated Sep 26, 2026•8•2•44

Detects command-line activity indicative of attempts to dump LSASS memory after performing in-memory unhooking or bypassing of security monitoring DLLs (ntdll.dll, amsi.dll, win32kbase.sys). This behavior is characteristic of adversaries attempting to harvest credentials while evading EDR/AV visibility.