T1003.001Credential Access

LSASS Memory Dumping

LSASS holds the credentials of everyone logged into a Windows host. Dumping its memory is the classic credential-theft step. Here is the handle-access signature and the rules that catch it.

Run it live: Phishing to Lateral Movement

A domain-joined workstation and DC with Sysmon. Land on the workstation, dump credentials, move to the DC, and watch the handle-access and remote-service events in Wazuh.

Launch it

The Local Security Authority Subsystem Service (lsass.exe) caches credentials for active sessions so Windows can do single sign-on. That makes its memory a treasury: dump it and you get password hashes, Kerberos tickets, and sometimes cleartext. Mimikatz is the famous tool, but the technique is tool-agnostic, comsvcs.dll, Task Manager, procdump, and custom loaders all do the same thing: open a handle to lsass and read its memory.

What it looks like

The most durable signal is not the tool, it is the process handle access to lsass. Sysmon Event ID 10 (ProcessAccess) records the source process, the target (lsass.exe), and the granted access mask. Dumping needs read rights, so masks containing 0x1010 or 0x1410 (PROCESS_VM_READ | PROCESS_QUERY_INFORMATION) from an unusual process are the tell.

Sysmon EID 10: TargetImage ends with lsass.exe, GrantedAccess 0x1010 / 0x1410 / 0x143a.
Source process is not a known security product (AV/EDR legitimately touch lsass).
Often paired with Sysmon EID 11 writing a .dmp file, or comsvcs.dll MiniDump in the command line.
LOLBAS variant: rundll32 comsvcs.dll, MiniDump <pid> <path> full.

Detect it: Sigma

sigma / lsass-handle-access.yml

title: LSASS Memory Access with Read Rights
id: 0f1a2b3c-lsass-4d5e-6f70-tyrian000003
status: stable
logsource:
  category: process_access
  product: windows        # Sysmon Event ID 10
detection:
  selection:
    TargetImage|endswith: '\\lsass.exe'
    GrantedAccess:
      - '0x1010'
      - '0x1410'
      - '0x143a'
      - '0x1438'
  filter_known:
    SourceImage|endswith:
      - '\\MsMpEng.exe'          # Defender
      - '\\wmiprvse.exe'
  condition: selection and not filter_known
level: high
tags:
  - attack.credential_access
  - attack.t1003.001

Detect it: Wazuh (Sysmon via the Windows agent)

wazuh / local_rules.xml

<group name="sysmon,attack,">
  <rule id="100310" level="12">
    <if_group>sysmon_event_10</if_group>
    <field name="win.eventdata.targetImage">lsass\.exe$</field>
    <field name="win.eventdata.grantedAccess">0x1010|0x1410|0x143a|0x1438</field>
    <description>Credential dumping: LSASS memory read access (T1003.001)</description>
    <mitre>
      <id>T1003.001</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <!-- comsvcs.dll MiniDump LOLBAS variant via process creation -->
  <rule id="100311" level="12">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.commandLine">comsvcs\.dll.*MiniDump</field>
    <description>Credential dumping: comsvcs.dll MiniDump of LSASS (T1003.001)</description>
    <mitre>
      <id>T1003.001</id>
    </mitre>
  </rule>
</group>

Harden

Enable LSA Protection (RunAsPPL) so LSASS runs as a protected process.
Turn on Credential Guard on supported hardware to move secrets out of LSASS.
Tune out your AV/EDR's legitimate LSASS access so the alert stays high-signal.
Make sure Sysmon EID 10 is actually collected, it is the whole detection, and often the gap.

In Tyrian's Phishing to Lateral Movement scenario you land on a domain workstation, dump credentials, and pivot to the domain controller, with Sysmon feeding Wazuh so you can see whether the handle-access rule fires and how fast.

Test this detection on your own SIEM

Launch the Phishing to Lateral Movement range, fire T1003.001, and measure how fast you catch it. $5 free credit, no card.

Start free More techniques