T1003.001: LSASS Memory
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
For example, on the target host use procdump:
* procdump -ma lsass.exe lsass_dump
Locally, mimikatz can be run using:
* sekurlsa::Minidump lsassdump.dmp * sekurlsa::logonPasswords
Built-in Windows tools such as `comsvcs.dll` can also be used:
* rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp fullCitationVolexity Exchange Marauder March 2021CitationSymantec Attacks Against Government Sector
Similar to Image File Execution Options Injection, the silent process exit mechanism can be abused to create a memory dump of `lsass.exe` through Windows Error Reporting (`WerFault.exe`).CitationDeep Instinct LSASS
Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.CitationGraeber 2014
The following SSPs can be used to access credentials:
* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package. * Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.CitationTechNet Blogs Credential Protection * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later. * CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.CitationTechNet Blogs Credential Protection
Security context for executives and security teams
LSASS Memory is a Windows credential-access technique where an attacker with administrative or SYSTEM-level access attempts to read or dump credential material from the LSASS process. The business issue is not just credential theft on one host: harvested passwords, hashes, or authentication material can enable lateral movement and broader compromise of domain resources. For leaders, this technique is a useful test of whether endpoint hardening, privileged access controls, and SOC visibility are strong enough to contain a compromised Windows system before it becomes an enterprise-wide incident.
Executive priority
Prioritize this as a Windows identity-resilience and incident-containment control area. Ask whether privileged users routinely sign in to workstations and servers where LSASS exposure would create high-value credential risk, whether LSASS protection and credential-access prevention are consistently configured, and whether the SOC can prove it sees suspicious LSASS access and dump sequences. This technique also matters for audit and compliance evidence because it links endpoint control posture, privileged account management, password policy, and credential protection to measurable detection and response readiness.
Technical view
ATT&CK identifies this as a Windows sub-technique of OS Credential Dumping under Credential Access. The supplied relationship context includes DET0363, Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence, and mitigations covering privileged process integrity, privileged account management, password policies, operating system configuration, endpoint behavior prevention, credential access protection, and user training. SOC and IR teams should validate visibility into processes attempting unusual access to lsass.exe, creation of LSASS dump files, use of built-in Windows components associated with memory dumps, Windows Error Reporting abuse paths, and registry changes to LSA Security Packages keys that could load Security Support Provider DLLs into LSASS. Treat findings in context: legitimate security tools and administrators may interact with LSASS, so detections should combine process lineage, access rights, dump creation, command context, file location, account privilege, and host role.
Likely telemetry
- Windows endpoint process creation and command-line telemetry
- Process access events involving lsass.exe, especially high-privilege access patterns
- File creation telemetry for memory dump artifacts and unusual dump locations
- Registry monitoring for HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages
- Windows Error Reporting and WerFault.exe-related activity where available
Detection direction
- Validate detections against the ATT&CK-related DET0363 concept: suspicious access to LSASS followed by dump or credential extraction-related activity.
- Tune detections to distinguish approved administrative or security tooling from unexpected tools, unusual parent-child process chains, nonstandard dump paths, and activity by accounts that should not access LSASS.
- Monitor both direct memory access and indirect dump mechanisms, including abuse of built-in Windows functionality and Windows Error Reporting paths described by ATT&CK.
- Add registry-based detection for changes to LSA Security Packages keys because malicious or unauthorized SSP configuration can expose credentials after load or reboot.
- Use host role and privilege context to prioritize alerts: LSASS access on domain controllers, administrative workstations, servers with privileged sessions, or systems used by IT staff should carry higher response urgency.
Mitigation priorities
- Start with privileged account management: reduce where administrative and high-value domain credentials are exposed, enforce least privilege, and limit routine privileged logons to broad Windows fleets.
- Harden privileged process integrity for LSASS where supported, including protected process mechanisms referenced in the related mitigation context.
- Apply credential access protection and operating system configuration baselines to reduce stored credential exposure and restrict abuse of credential storage mechanisms.
- Use endpoint behavior prevention controls to block or interrupt suspicious LSASS access and dump behavior where feasible.
- Strengthen password policies to reduce reuse and limit the value of harvested credentials, while recognizing that password policy alone does not prevent LSASS access.
Additional notes and limits
The relationship set shows broad adversary and campaign use, including espionage, disruptive, and cyber-physical contexts such as electric power and safety-instrumented system campaigns. That makes LSASS Memory a high-value defensive validation point, but the supplied data should not be read as evidence of current exploitation in any specific environment. The technique is especially relevant where Windows identity, privileged access, and operational continuity intersect.
MITRE does not provide an official detection text for this object in the supplied fields. The take is therefore based on the official description, external references, and relationships, especially DET0363 and the listed mitigations. Local host configuration, EDR capabilities, logging depth, administrative practices, and approved security tools are required to determine real detection coverage and false-positive handling.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
LSASS Memory
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
For example, on the target host use procdump:
* procdump -ma lsass.exe lsass_dump
Locally, mimikatz can be run using:
* sekurlsa::Minidump lsassdump.dmp * sekurlsa::logonPasswords
Built-in Windows tools such as `comsvcs.dll` can also be used:
* rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp fullCitationVolexity Exchange Marauder March 2021CitationSymantec Attacks Against Government Sector
Similar to Image File Execution Options Injection, the silent process exit mechanism can be abused to create a memory dump of `lsass.exe` through Windows Error Reporting (`WerFault.exe`).CitationDeep Instinct LSASS
Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.CitationGraeber 2014
The following SSPs can be used to access credentials:
* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package. * Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.CitationTechNet Blogs Credential Protection * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later. * CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.CitationTechNet Blogs Credential Protection
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.