How to defend against LSASS credential dumping

What the attacker does

lsass.exe (Local Security Authority Subsystem Service) keeps the credentials of logged-on users in memory: NTLM hashes, Kerberos tickets and, on older configurations, reusable passwords. An attacker with administrator rights reads that memory, either directly (Mimikatz) or by writing a dump file and reading it elsewhere: rundll32.exe comsvcs.dll, MiniDump, Task Manager's "Create dump file", ProcDump, or tools such as Dumpert that call the kernel directly to avoid monitored API functions. The stolen hashes and tickets are then used to log on to other machines.

What it looks like in the logs

Before reading the memory, the tool opens a handle to lsass.exe. Sysmon records this as a process access event (Event ID 10, category: process_access) with the access rights it asked for (GrantedAccess) and the chain of code that asked (CallTrace). One of the accesses in the recordings, by Dumpert:

0x1fffff is every right on the process. A tool that reads memory needs at least PROCESS_VM_READ (0x0010).

Detect

Measured on the challenge data: the rule caught 8 of 8 attack events and matched 0 of 4,346 normal events.

title: Process opens LSASS in a way used for credential dumping
id: 1d6a9c4f-7b30-4e85-b2d7-9f0e3a6c5b18
status: test
description: Detects handles to lsass.exe opened by code that was not loaded from a file (CallTrace contains UNKNOWN), by rundll32.exe (the comsvcs.dll MiniDump technique), or with full access by a process other than the system components that do this normally.
references:
  - https://attack.mitre.org/techniques/T1003/001/
  - https://howdefend.com/defend/lsass-credential-dumping/
author: Bartu Kılıç
date: 2026-10-20
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: process_access
detection:
  selection_target:
    TargetImage|endswith: '\lsass.exe'
  selection_unknown:
    CallTrace|contains: 'UNKNOWN'
  selection_full:
    GrantedAccess: '0x1fffff'
  selection_comsvcs:
    SourceImage|endswith: '\rundll32.exe'
  filter_system:
    SourceImage|endswith:
      - '\msiexec.exe'
      - '\wininit.exe'
      - '\csrss.exe'
  condition: selection_target and (selection_unknown or selection_comsvcs or (selection_full and not filter_system))
falsepositives:
  - Endpoint security and backup agents that read LSASS memory (add them by full path)
  - Task Manager when an administrator creates a dump of lsass.exe on purpose
level: high

What the rule misses

• Tools that ask for less. Reading memory needs 0x0010, not full access. The rule catches narrower requests only from rundll32.exe or from unbacked code; a dedicated tool that asks for 0x1010 from an ordinary executable passes. Adding those masks brings in normal software: on the clean Windows 10 client, Windows Installer and an update service ask for exactly these rights.
• Handles not opened on LSASS. Some techniques duplicate an existing handle from another process, or read credentials from elsewhere (the SAM hive, NTDS.dit, replication from a domain controller).
• Missing logging. Process access events are numerous, so many Sysmon configurations filter them. The configuration must keep access to lsass.exe.

Prevent

• LSA protection. Set RunAsPPL under HKLM\SYSTEM\CurrentControlSet\Control\Lsa (1 with a UEFI lock, 2 without) and restart. LSASS then runs as a protected process, and code that is not signed for that protection level cannot read its memory. It is on by default only on new installations of Windows 11 22H2 and later that are joined to Active Directory or Microsoft Entra and can run memory integrity; plug-ins loaded into LSA must be signed by Microsoft, so audit first.
• Credential Guard. Keeps NTLM hashes and Kerberos tickets in an isolated environment that LSASS memory does not contain.
• Attack surface reduction. Microsoft Defender's rule "Block credential stealing from the Windows local security authority subsystem" (9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2). Microsoft notes that it is redundant when LSA protection is enabled.
• Fewer administrators. Every technique on this page needs administrator or debug rights on the machine.

Practice

Write the rule yourself on the same data, with every target labelled.

Sources

• MITRE ATT&CK: T1003.001 LSASS Memory
• Microsoft Learn: Configure added LSA protection
• Microsoft Learn: Attack surface reduction rules reference
• OTRF Security-Datasets (attack recordings used on this page)