Outflank's proof-of-concept Dumpert targets LSASS memory using direct system calls and API unhooking. The repository has executable and DLL builds plus an sRDI variant with a Cobalt Strike Aggressor script that injects the payload into the current process and later downloads the LSASS minidump. The README claims the collection can avoid disk access and user-mode API monitoring; this author-stated objective does not establish a fileless end-to-end workflow or bypass of current endpoint controls.
C and assembly
RESTRICTED_ACCESS_BLUR_MARKER