Detection of Credential Dumping via LSASS Memory Access

The Local Security Authority Subsystem Service (LSASS) is a core Windows process responsible for enforcing security policies and managing user credentials. Because it stores sensitive information in memory, including plaintext passwords and NTLM hashes, it is a primary target for attackers seeking to move laterally or elevate privileges within a compromised environment.

This threat brief outlines a detection strategy for identifying unauthorized attempts to access LSASS memory. Attackers utilize various techniques and tools - often associated with adversary playbooks like BlackSuit, Lokibot, or Scattered Lapsus$ - to perform memory dumping. By monitoring for specific process access masks via Sysmon, defenders can identify suspicious tools attempting to read the memory space of lsass.exe. This capability is critical for uncovering credential theft activities during the post-exploitation phase, providing visibility into internal reconnaissance and persistence mechanisms before attackers exfiltrate data or deploy ransomware.

Impact

Successful dumping of LSASS memory allows adversaries to acquire domain credentials, leading to full network compromise, unauthorized access to sensitive systems, and potential data exfiltration or ransomware deployment. This technique is observed across a wide range of cyber-criminal and state-sponsored activity.

Recommendation

• Deploy Sysmon and enable EventID 10 (ProcessAccess) specifically for monitoring the lsass.exe process.
• Implement the provided detection logic to flag processes requesting 'PROCESS_VM_READ' access to LSASS memory.
• Tune the detection by baseline auditing of legitimate administrative or security tools that perform expected operations on LSASS, creating an allowlist for known benign binary paths.
• Integrate detection alerts into a centralized SIEM to initiate an incident response process for suspected credential theft.