procdump lsass

procdump.exe -accepteula -ma lsass.exe lsass.dmp

Dump the full memory of the lsass.exe process to a .dmp file using Sysinternals procdump, to extract credentials offline with mimikatz.

When you want to steal credentials without running mimikatz on the host (avoiding its EDR signatures): procdump is a Microsoft-signed tool, and the dump is analyzed later on your machine with mimikatz sekurlsa::minidump. Very effective against EDR that only flags mimikatz.

If lsass is protected by PPL (LSA Protection/Credential Guard), procdump will not be able to open the process (access denied). Also not if you lack administrator privileges: SeDebugPrivilege is required.