In-Memory Credential Dumping via GDB

Tim Peck@timpeck

•updated Jan 30, 2026•3•0•52

Detects the use of GDB (GNU Debugger) to dump the memory of a running process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets from live processes without writing traditional credential dumping tools to disk.