{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/lsass.exe/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["lsass.exe"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eAdversaries frequently target the Local Security Authority Subsystem Service (LSASS) process on Windows systems to extract sensitive credentials, including plaintext passwords, NTLM hashes, and Kerberos tickets. By dumping the process memory of lsass.exe, attackers can facilitate privilege escalation, lateral movement, and persistence. This activity is a hallmark of sophisticated post-exploitation toolkits and is commonly associated with ransomware operations (e.g., Cactus Ransomware) and information stealers (e.g., Lokibot). Defenders should monitor for unauthorized processes attempting to obtain handle access to lsass.exe using specific system debugging libraries. The detection focuses on Sysmon Event ID 10 logs identifying calls to dbgcore.dll or dbghelp.dll, which are standard components used by dumping utilities.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to a Windows host.\u003c/li\u003e\n\u003cli\u003eThe attacker elevates privileges to Administrator or SYSTEM level.\u003c/li\u003e\n\u003cli\u003eThe attacker deploys a memory-dumping tool or executes native Windows commands (e.g., ProcDump, comsvcs.dll via rundll32.exe).\u003c/li\u003e\n\u003cli\u003eThe dumping tool initiates a process handle request to lsass.exe with specific access rights (e.g., PROCESS_QUERY_LIMITED_INFORMATION or PROCESS_VM_READ).\u003c/li\u003e\n\u003cli\u003eThe dumping tool utilizes the Windows APIs dbghelp.dll or dbgcore.dll to facilitate the memory read operation.\u003c/li\u003e\n\u003cli\u003eThe memory dump file (e.g., lsass.dmp) is written to the local disk.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates the dump file or processes it locally using tools like Mimikatz to extract credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful LSASS memory dumping grants an adversary access to cleartext credentials and authentication material for all users logged into the system. This level of access typically leads to full domain compromise, as attackers can leverage stolen administrative credentials to move laterally, access critical servers, and deploy ransomware or exfiltrate sensitive data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eEnable Windows Sysmon and configure Event ID 10 (ProcessAccess) logging to track handles requested against lsass.exe.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to identify suspicious library imports associated with memory dumping.\u003c/li\u003e\n\u003cli\u003eAudit environments for the presence of known credential dumping tools like Mimikatz, ProcDump, or Cobalt Strike beacons.\u003c/li\u003e\n\u003cli\u003eRestrict administrative privileges to limit the ability of non-privileged users to request handles on sensitive system processes.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T17:35:50Z","date_published":"2026-10-12T17:35:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-lsass-dump-detection/","summary":"This brief details the detection of credential dumping attempts targeting the LSASS process memory, often observed in campaigns by actors such as Scattered Lapsus$ or during ransomware deployment.","title":"Detection of LSASS Memory Dumping via Sysmon","url":"https://feed.craftedsignal.io/briefs/2026-10-lsass-dump-detection/"}],"language":"en","title":"CraftedSignal Threat Feed - Lsass.exe","version":"https://jsonfeed.org/version/1.1"}