Impacket secretsdump LSASS credential dumping via portable mini_imp bundle

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects various methods and tools commonly used by adversaries for credential dumping, including process memory dumping of lsass.exe via procdump or comsvcs.dll, and the execution of credential dumping tools like Impacket's secretsdump, ntlmrelayx, or Mimikatz.