Hooks for intercepting SpAcceptLsaModeContext to print any incoming authentication attempts to Beacon. The hook is installed on the Lsass heap to make it easy, rather than hooking the DLL image directly.
Written by Austin Hudson
SolomonSklash/netntlm
A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP
C