GhostKatz extracts LSASS credentials from physical memory using vulnerable signed drivers. Developed by Julian Peña and Eric Esquivel, it allows users to exploit known driver vulnerabilities for credential dumping. The tool is modular, enabling research on additional drivers.

The article discusses how to exploit the Windows Error Reporting tool WerFaultSecure.exe to dump the memory area of the LSA process on modern Windows 11 systems. It details the use of specific undocumented parameters and a loader named WSASS to bypass protections and retrieve sensitive cached passwords from LSASS.EXE. The author provides technical insights into the process and references previous vulnerabilities found in older versions of the tool.