LSASS credential dumping, and how to actually catch it
LSASS is where Windows keeps the keys. Dumping it (T1003.001) is a favorite of every ransomware crew, and one of the highest-fidelity things you can detect.
By The Tyrian team
The Local Security Authority Subsystem Service (LSASS) holds credential material, password hashes, Kerberos tickets, in memory. Reading it (ATT&CK T1003.001) hands an attacker the keys to move laterally. The good news: it's high-signal to detect if you're collecting the right event.
How it's done
Tools open a handle to lsass.exe with read rights and copy its memory, either with a purpose-built tool or by abusing legitimate ones (comsvcs.dll MiniDump, task manager). The common thread is a process opening lsass.exe with suspicious access rights.
How to catch it
- Enable Sysmon EID 10 (ProcessAccess) and alert on non-system processes opening lsass.exe with PROCESS_VM_READ.
- Turn on Credential Guard so the secrets aren't there to steal in the first place.
- Add LSASS as a protected process (RunAsPPL) to raise the bar.
- Watch for known dumping patterns, comsvcs MiniDump, rundll32 touching lsass.
See it on a real range
Run the interactive kill chain free, or create an account and start with $5 of credit.