KslDump

KslDump is a cybersecurity tool designed to extract credentials from the Protected Process Light (PPL)-protected Local Security Authority Subsystem Service (LSASS) using only components signed by Microsoft, without deploying any additional exploits or drivers. Its primary use case revolves around leveraging a forgotten vulnerable kernel driver (KslD.sys) within Microsoft Defender, which allows unrestricted access to kernel and physical memory. Notably, it utilizes a vulnerable IOCTL command to perform memory reads, exploiting easily editable access controls that lack adequate validation mechanisms.