Windows tokens: how to compromise a Active Directory without touching LSASS // WhiteFlag
October 24, 2023 at 10:11:35 AM UTC - permalink -

- https://blog.whiteflag.io/blog/exploiting-windows-tokens/

SensePost | Recreating known universal windows password backdoors with frida
December 8, 2022 at 1:12:52 PM UTC - permalink -

- https://sensepost.com/blog/2019/recreating-known-universal-windows-password-backdoors-with-frida/

The hidden side of Seclogon part 3: Racing for LSASS dumps
September 12, 2022 at 12:52:47 PM UTC - permalink -

- https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html

LSASS dumping in 2021/2022 - from memory - without C2 | S3cur3Th1sSh1t
September 8, 2022 at 4:02:20 PM UTC - permalink -

- https://s3cur3th1ssh1t.github.io/Reflective-Dump-Tools/

Yaxser/Backstab: A tool to kill antimalware protected processes
January 12, 2022 at 12:01:12 PM UTC - permalink -

- https://github.com/Yaxser/Backstab

Bypassing LSA Protection (aka Protected Process Light) without Mimikatz on Windows 10 - RED CURSOR
November 20, 2020 at 12:41:31 AM UTC - permalink -

- https://www.redcursor.com.au/blog/bypassing-lsa-protection-aka-protected-process-light-without-mimikatz-on-windows-10