lsass.exe

Overview

LSASS (Local Security Authority Subsystem Service, lsass.exe) is the core Windows security process that enforces local security policy, validates credentials, maintains authentication packages, and manages Kerberos and NTLM operations.

Expected location:

Expected parent:

Typical profile:

Why This Matters

Attackers target lsass.exe to extract credentials and tokens from memory during or after initial access and prior to lateral movement.

Common behaviours align with MITRE ATT&CK:

Secondary techniques commonly encountered include:

Investigation Objective

Determine quickly whether any observed interaction with lsass.exe is:

Normal Behaviour

Characteristics

Path

Parent

Signature

Command Line

Lifetime

Children

Typical Activity

Expected Behavioural Characteristics

Abuse Patterns

Path or Signature Mismatch

Investigate immediately if:

Any lsass.exe instance outside System32 should be treated as malicious until proven otherwise.

Unexpected Parent or Launch Mechanism

Investigate if:

High-Risk LSASS Memory Access

Investigate non-security products requesting:

Particularly when access occurs immediately before:

Dump Artefacts and Tooling Patterns

Investigate:

Common credential dumping patterns include:

comsvcs.dll MiniDump

rundll32.exe comsvcs.dll, MiniDump

ProcDump

procdump.exe -ma <pid>

procdump.exe -64 <pid>

Other Tooling

Unexpected Child Processes

lsass.exe should not spawn child processes.

Any child process should be considered high severity.

Examples include:

powershell.exe

cmd.exe

rundll32.exe

wscript.exe

Module and Injection Indicators

Investigate:

Defensive Exceptions

Security products may access LSASS.

However, legitimate access usually has the following characteristics:

One-off administrative tools should not automatically be considered trustworthy.

Detection Opportunities

Handle Access Monitoring

Monitor for processes opening handles to lsass.exe with:

Particularly when the accessing process is:

Process Creation Analytics

Investigate execution of tools commonly associated with credential dumping.

Examples include:

procdump.exe

rundll32.exe comsvcs.dll, MiniDump

Look for these processes shortly before:

Dump File Monitoring

Search for:

Common locations include:

Module Load Monitoring

Alert on:

Correlated Activity

High-confidence findings often involve multiple indicators.

Examples:

Hunting Opportunities

Useful hunting pivots include:

Focus on unusual behaviour rather than simple presence of an LSASS access event.

False Positives

Legitimate security and platform components may access LSASS memory or enumerate tokens.

Validate publisher, path, and behavioural baselines carefully.

Common Legitimate Scenarios

Security Products

Examples include:

Characteristics:

Enterprise EDR Platforms

Many EDR products:

Behaviour should be:

Windows Error Reporting

Legitimate crash diagnostics may:

Administrative and Operational Activity

Examples include:

Protected Process Light Considerations

Protected Process Light (PPL) can sometimes cause:

This can appear suspicious despite completely legitimate behaviour.

Validation Questions

Check:

Compare against a known-good host whenever possible.

Hardening Recommendations

Enable LSASS Protection

Where supported, enable:

These controls significantly increase the difficulty of user-mode credential dumping.

Reduce Administrative Exposure

Limit:

Reducing privileged credentials reduces the value of LSASS as a target.

Application Control

Consider:

Preventing unauthorised tooling execution is often more effective than attempting to detect every credential dumper.

Monitor Credential Access Techniques

Implement visibility for:

Restrict Interactive Administrative Activity

Prefer:

Reduce opportunities for privileged credentials to reside in memory on lower-trust systems.

Validate Defensive Controls

Regularly test:

Controls should be validated against realistic tradecraft rather than simple demonstrations.

Triage Checklist

Identity and Integrity Checks

Access and Behaviour Checks

Service Context and Scope

Containment Considerations

If indicators persist:

ATT&CK References

Windows Processes

Active Directory

MITRE ATT&CK

Updated: