ПостHashSiphon

HashSiphon NTLM hash extraction through HTTP-layer authentication proxying, zero SSPI calls from the attacker process. HashSiphon extracts the current user's NetNTLMv2 hash by manipulating HTTP authentication flows instead of calling SSPI APIs directly. It ships two variants: v1 routes NTLM auth through .NET's HTTP stack within the same process, and v2 delegates authentication entirely to the BITS service (svchost.exe) in a different PID, breaking process-level attribution altogether. #AD