Skip to content
Threat Feed
Subscribe
medium advisory

Credential Dumping via LSASS Process Access

Multiple credential dumping tools, including Mimikatz, NanoDump, and Procdump, perform unauthorized memory access against the Local Security Authority Subsystem Service (LSASS) process to extract sensitive credentials.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 10, 02:47 UTC
Detection
1 rule
Source quality
A2Roughly even chance

Credential dumping tools frequently target the Windows LSASS process to extract plaintext passwords, NTLM hashes, or Kerberos tickets from memory. This activity typically involves opening a handle to lsass.exe with specific access masks to read memory segments, often utilizing legitimate system libraries like dbghelp.dll or dbgcore.dll. This behavior is commonly observed in tools such as Mimikatz, NanoDump, Invoke-Mimikatz, and Procdump, as well as the native Task Manager "Create dump file" feature.

Impact

Successful credential dumping allows attackers to harvest credentials from memory, facilitating lateral movement, privilege escalation, and persistence within the environment.

Recommendation

  • Deploy the detection rule below to identify suspicious handles being requested for the LSASS process.
  • Baseline legitimate administrative activity or security tooling that may trigger this rule, such as legitimate memory diagnostics or authorized security scanners, to tune out false positives.
  • Enable Sysmon process access logging (Event ID 10) to capture the necessary GrantedAccess and CallTrace telemetry.

Immediate actions

Enable Sysmon Event ID 10 to monitor LSASS process access

IT Operations 48h

Threat Hunt

Hunt for processes accessing lsass.exe with high-privilege access masks

T1003.001 high high confidence convert to detection

Data: Sysmon Event ID 10

Detection coverage 1

Detect Potential LSASS Credential Dumping

medium

Detects suspicious access requests to lsass.exe by common credential dumping tools using specific access masks and call traces associated with memory dumping functions.

sigma tactics: credential_access techniques: T1003.001 sources: process_access, windows

Detection queries are available on the platform. Get full rules →