LSASS process not found

[nemesis7331]

I'm using the same exe on the same cloned VM, first one works, second one has an EDR and I get this:

>whoami /all
...
SeDebugPrivilege                Debug programs                            Disabled

>tasklist
...
lsass.exe                      728 Services                   0     16,536 K

>nanodump.x64.exe -w dump
The LSASS process was not found. Are you elevated?

I'm guessing the EDR is doing something, but it has detected nothing, any idea?

p.s. the VM is obviously isolated from internet/cloud

[S4ntiagoP]

Hello! Are you running as admin?

[nemesis7331]

Hello :)
yes, also same user as the other VM

[S4ntiagoP]

try with
nanodump -w dump -p 728

[nemesis7331]

wow hidden command!

>nanodump.x64.exe -w dump -p 728
Failed to read LSASS, status: 0xc0000022

[S4ntiagoP]

haha that is the only hidden command, you can check if you don't trust me.
Looks like you can't read LSASS, that happens with some EDRs, in my experience, if you load nanodump as an SSP, it works on those cases.
I'm still trying to figure out how the manage to prevent you from reading LSASS

[nemesis7331]

It works thanks!
I'll let you know if I find out anything

[S4ntiagoP]

Awesome! I'm glad.
Out of curiosity, what EDR is it?

[nemesis7331]

Checkpoint, but I've also seen a similar behaviour with Sophos in the past

[S4ntiagoP]

Ok thanks, good to know.
I changed the error messages so this is easier to diagnose in the future: f718c2c
I'm closing this, thanks for letting me know, I will try to find out what is going on exactly and see if I can do anything about it.