Antonio Cocomazzi on Mythryl: “This MemProcFS has a lot of potentials. I have seen it also abused…”

@splintercode.bsky.social

This MemProcFS has a lot of potentials. I have seen it also abused by some ransomware operator to dump lsass. If you see the loading of such drivers and aren’t commonly used in your environment then you should set some alerts based on that.

dragosr@dragostech.bsky.social

MemProcFS views physical memory as files in a virtual file system. Analyzes memory dump files, live memory via DumpIt or WinPMEM, live memory in read-write mode from virtual machines or from PCILeech FPGA hardware devices. github.com/ufrisk/MemPr...

github.comGitHub - ufrisk/MemProcFS: MemProcFSMemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.

14/11/24, 10:25 pm0 reposts3 likes

Post