diff --git a/atomics/T1003.001/T1003.001.yaml b/atomics/T1003.001/T1003.001.yaml index 4e5ee4cc..eb902b08 100644 --- a/atomics/T1003.001/T1003.001.yaml +++ b/atomics/T1003.001/T1003.001.yaml @@ -358,6 +358,7 @@ atomic_tests: elevation_required: true - name: Dump LSASS.exe using imported Microsoft DLLs + auto_generated_guid: 86fc3f40-237f-4701-b155-81c01c48d697 description: | The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index eba1dedd..d80b426b 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -692,3 +692,4 @@ c75612b2-9de0-4d7c-879c-10d7b077072d e86f1b4b-fcc1-4a2a-ae10-b49da01458db 10447c83-fc38-462a-a936-5102363b1c43 fcbdd43f-f4ad-42d5-98f3-0218097e2720 +86fc3f40-237f-4701-b155-81c01c48d697