Dump credentials from a VM you own and see what EDR sees

short · 60 min · Objective 4.3

Task

Dump credential material from a machine you built where you have administrative rights, handle it as the client data it would be, and observe what endpoint monitoring records — because dumped material is client data first and evidence second, and injection is about living inside a trusted process where the defender is watching.

Steps

  1. On the lab you own, build a disposable VM, create a couple of accounts you own, and log one of them in so credential material is resident. Snapshot it.
  2. With administrative rights on that VM, dump the resident credential material.
  3. Handle it under the data rules: take the minimum that proves the finding, store it encrypted, and plan to delete it — treat it as client data even though it is yours.
  4. Demonstrate process injection with a benign stand-in you wrote — a harmless program that injects a marker into another process you own — so you see the shape without running any real malware.
  5. Enable and read endpoint logging, and record what it saw for both the dump and the injection.
  6. Revert the snapshot and confirm the material is destroyed.

Verify

grep -ciE "encrypted|minimum|delete|client data" /tmp/handling.md
grep -ciE "benign|stand-in|marker|harmless" /tmp/injection.md
grep -ciE "edr|endpoint|event|detected|observed" /tmp/edr-view.md

The first count must be non-zero: you recorded handling the dumped material as client data — encrypted, minimal, destroyed. The second must be non-zero: the injection used a benign stand-in you wrote, never real malware. The third must be non-zero: you recorded what endpoint monitoring saw, which is the defender's half and the basis for the remediation.

Notes

Injection is about living inside a trusted process, which is why it is worth recognising rather than performing against anything real — here it is a marker into a process you own. Material you dump is client data first: minimum necessary, encrypted, deleted on schedule. What EDR sees is the finding's defender side. Everything ran on a disposable VM you built, with accounts you created and a stand-in you compiled — no live malware anywhere.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.