Intercepting passwords with Empire and winning!

This blog post outlines a red-team technique for capturing newly changed Active Directory passwords by reflectively injecting a statically linked `HookPasswordChange.dll` into `lsass.exe` using Empire’s `Invoke-ReflectivePEInjection`, then exfiltrating credentials to a Metasploit `auxiliary/server/capture/http_basic` listener; it emphasizes x64-only constraints, correct process targeting, and configuration steps rather than describing a specific incident.