T1003.001sub-technique of T1003 OS Credential Dumping
LSASS Memory
Windows11 pieces on this siteT1003.001 on attack.mitre.org
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
If this is happening now
Checklists and playbooks to open while the alert is still live.
First 15 minutes: an LSASS credential dump alert on a server
A process that is not a security product has read LSASS memory. What to do before the playbook opens, in the order that protects the evidence and stops you adding your own credentials to the pile.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma endpoint pack: seven rules for the Windows techniques that keep working
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
YARA triage samples: five heuristic rules for a web root, a script directory or a triage collection
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
Hunt: rundll32 calling the comsvcs MiniDump export
Finds LSASS dumps taken with a DLL that ships in System32, whether the export is named or called by ordinal. One idea in three query languages, each bounded to seven days.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Sysmon operational log
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: the credential dump that used nothing but Windows
An LSASS dump taken with a DLL that ships in System32, called by ordinal so the obvious rule misses it. Work out which process touched LSASS, which access mask matters, and whose credentials you now have to assume are gone.
Guided lab: nine hours at Northwind Freight, from lure to scheduled task
A constructed intrusion written as a DFIR report. You get the same artifacts an analyst gets on day one, in the order they arrive, and you build the timeline yourself. The company is fictional; the techniques, event IDs and analytic reasoning are not.
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
Read
Analyses, case studies, guides, references and interview questions.
False-Positive Hall of Fame No. 1: six alerts that were the software working
Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.
Incident report: Kesterline Components, 8 May 2026
A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.
Memory forensics cheat sheet: acquisition order and the Volatility 3 plugins that answer real questions
What to capture before you touch anything else, how to check the image is usable, and the Volatility 3 plugins grouped by the question they answer, with what each one cannot tell you.
how MITRE says to see it
Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence
- A non-privileged or abnormal process attempts to open a handle with full access (0x1F0FFF) to lsass.exe and subsequently invokes memory dump, file creation, or registry modification indicative of credential scraping. This behavior chain reflects staged credential theft activity.
what reduces it
- M1017 User Training. Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
- M1028 Operating System Configuration. Consider disabling or restricting NTLM. Consider disabling WDigest authentication.
- M1043 Credential Access Protection. With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.
- M1025 Privileged Process Integrity. On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.
- M1027 Password Policies. Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
- M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.