CopperLsass DarkWire Payload Execution and LSASS Credential Dump

Kaung Khant Ko@kaungkhantko

•updated yesterday•3•0•3

Detects the loading of specific malicious DLLs (slave.dll or dep.dll) into the LSASS process space, followed by the creation or renaming of an encrypted LSASS dump file (such as 1.png), characteristic of the CopperLsass / DarkWire framework.