ShadowDumper NtOpenProcess Syscall Stub in RWX Memory Targeting LSASS

Ethan Andrews@eandrews

•updated Jun 30, 2026•0•0•1

Detects a non-system process that allocates executable memory (consistent with custom syscall stub staging) and subsequently opens a handle to the LSASS process. This behavior correlates the preparation of custom syscall stubs (often used to bypass user-mode API hooking) with the direct interaction with LSASS, which is a high-confidence indicator of credential dumping activity.