Added Dump example to TTTracer.exe

This commit is contained in:
Oddvar Moe 2019-11-18 12:50:49 +01:00
parent e0db5721ff
commit 94a295213e

View File

@ -12,7 +12,7 @@ Commands:
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows 10 1809 and newer
- Command: TTTracer.exe -dumpFull -attach <lsass_pid>
- Command: TTTracer.exe -dumpFull -attach pid
Description: Dumps process using tttracer.exe. Requires administrator privileges
Usecase: Dump process by PID
Category: Dump