The EvilLsassTwin project on GitHub, found in the Nimperiments repository, focuses on a specific technique for extracting credentials from the Local Security Authority Subsystem Service (LSASS) process on Windows systems. 📌Objective: The project aims to demonstrate a method for credential dumping from the LSASS process, which is a common target for attackers seeking to obtain sensitive information such as passwords and tokens. 📌Technique: The method involves creating a «twin» of the LSASS process...

Microsoft представила Administrator Protection — кардинально новую архитектуру управления административными привилегиями в Windows 11 версиях 24H2 и 25H2. Функция переопределяет парадигму, которая существовала со времён Windows Vista, заменяя традиционный постоянный admin-доступ на модель just-in-time привилегий. User Login with Admin Account ↓ Session Token: User ID + Admin Token (PERSISTENT) ↓ Malware/Attacker Steals Token ↓ Full Admin Access WITHOUT Re-authentication ↓ КОМПРОМЕТАЦИЯ...