Bypass antivirus about lsassy

[mpgn]

"secret technique"

[Hackndo]

Hey there,
Thanks for this issue. I would need some details though. I'm not sure I understand how this is different from what lsassy actually does.
Maybe I missed something?

[Hackndo]

This technique is described here
https://github.com/Hackndo/lsassy/wiki/Lsassy-Advanced-Usage#procdump-method

[viaccoz]

Hello,

This technique first reads the process ID of lsass.exe and then dumps the lsass.exe process based on its process ID.

If you directly dump lsass.exe (instead of using its process ID), as lsassy does, it is blocked by some products. I could see this behavior with Microsoft Defender.

[Hackndo]

Yes, this is what is used by lsassy with procdump method.
https://github.com/Hackndo/lsassy/blob/master/lsassy/modules/dumper.py#L207

[viaccoz]

I've tried it again on a lab with Defender. No idea what I did, it works. Sorry!