LSASS Memory Theft

Also calledLSASS dump, Credential dumping

Reads the hashes and tickets that sign-ins left on a machine out of LSASS memory.

Technique: MITRE ATT&CK T1003.001: OS Credential Dumping: LSASS Memory (opens in a new tab)
Needs: Local Admin
Gives: NT HashandAES KeyandTGT

How the Attack Works

Single sign-on means LSASS keeps what a user needs to reach other machines without signing in again, such as their NT hash, Kerberos keys and tickets. Code running with admin rights on the machine can open LSASS and read them, or write its memory to a file and read them elsewhere. How an account signed in decides what is left behind. An interactive or Remote Desktop sign-in leaves reusable secrets, while a network sign-in such as opening a share normally does not.

Read first Credentials on a Running Machine, Password Hashes and Kerberos Keys

How It Plays Out

The attack step by step. Each step shows which machines take part, what travels, the keys and tickets each side now holds, what is logged and what a defender can see.

CORP\adm-alice manages srv-fin-01 over Remote Desktop from ws-042. Code with admin rights on srv-fin-01 then reads LSASS.Step through it

ws-042 Admin's laptop

srv-fin-01 File server

srv-fin-01 key

Offline

Step 1 of 4, Remote Desktop Sign-In, ws-042 to srv-fin-01
Step 2 of 4, LSASS Memory Read, on srv-fin-01
Step 3 of 4, Dump Taken Away, srv-fin-01 to Offline
Step 4 of 4, Secrets Read Out, on Offline

Step 1 of 4: Remote Desktop Sign-In
ws-042 Admin's laptop to srv-fin-01 File server
adm-alice's password goes to srv-fin-01, which signs her in and keeps her NT hash, keys and TGT in LSASS.
Keys and Tickets
- srv-fin-01 now holds TGT (new at this step) TGT session key (new at this step)
Logged
- 4624 An account was successfully logged on
  On srv-fin-01, in the Security log
  Logon Type 10 for CORP\adm-alice from WS-042, Restricted Admin Mode No
  Reading Logon Events explains how to read it.
What Defenders See
The Security log on srv-fin-01 shows event 4624 with Logon Type 10 for adm-alice from 192.0.2.42, and Restricted Admin Mode No.
Step 2 of 4: LSASS Memory Read
On srv-fin-01 File server
A process with admin rights on srv-fin-01 opens LSASS and reads its memory, or writes it to a dump file.
Logged
- 10 ProcessAccess
  On srv-fin-01, in the Microsoft-Windows-Sysmon/Operational log When enabled
  The process that opened lsass.exe and the access it asked for
- 1121 Event when rule fires in block mode
  On srv-fin-01, in the Microsoft-Windows-Windows Defender/Operational log When enabled
  The ASR rule for LSASS stopped a process reading it
- 1116 The antimalware platform detected malware or other potentially unwanted software
  On srv-fin-01, in the Microsoft-Windows-Windows Defender/Operational log When enabled
  Defender named a credential theft tool or a dump of LSASS
What Defenders See
On srv-fin-01, the Microsoft-Windows-Sysmon/Operational log shows Sysmon event 10 with TargetImage lsass.exe. The Microsoft-Windows-Windows Defender/Operational log shows the ASR rule's event 1121 (or 1122 in audit mode) and a Defender detection, event 1116.
Step 3 of 4: Dump Taken Away
srv-fin-01 File server to Offline
The dump file, or the secrets already read from it, are copied off srv-fin-01.
Keys and Tickets
- Offline now holds TGT (new at this step) TGT session key (new at this step)
What Defenders See
Endpoint file and network events from srv-fin-01 show a new dump file and its copy leaving the server.
Step 4 of 4: Secrets Read Out
Offline, away from the network
adm-alice's NT hash, AES keys and tickets come out of the dump, the material that pass-the-hash and pass-the-ticket reuse.
What Defenders See
No log on any machine in the domain records this step, because it happens offline.

Needs First

What the attacker must already hold for this attack to be possible.

Local Admin RightsAdmin rights or SYSTEM on the machine. What it yields depends on who has signed in there.

Comes From

Local Admin: Pass-the-Hash, Pass-the-Ticket, Silver Ticket, Golden Ticket every attack that gives it: Local Admin Rights

Gives the Attacker

What running it hands the attacker to use next.

An NT HashNT hashes left there by console, Remote Desktop, service and task sign-ins, for pass-the-hash.
An AES KeyTheir Kerberos AES keys, which get TGTs just as their passwords would.
A TGTTheir TGTs and service tickets with session keys, usable elsewhere until they expire.

Leads To

NT Hash: Pass-the-Hash, Overpass-the-Hash
AES Key: Overpass-the-Hash
TGT: Pass-the-Ticket

What Defenders See

What this attack leaves for a defender to find, and what to read in each. None of it is proof on its own, so treat each as a lead and confirm it against the rest.

Event and Log	Written On	Look For	Switch It On
10 `ProcessAccess` (opens in a new tab) Microsoft-Windows-Sysmon/Operational log	Any Windows computer running Sysmon	TargetImage lsass.exe opened by a process that is not a known security, backup or system tool, asking to read its memory.	Sysmon, with a configuration that records ProcessAccess to lsass.exe
1121 `Event when rule fires in block mode` (opens in a new tab) Microsoft-Windows-Windows Defender/Operational log	The computer the attack surface reduction rule runs on	The LSASS rule (9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) stopping a process, and which process it was.	An attack surface reduction rule in block mode
1122 `Event when rule fires in audit mode` (opens in a new tab) Microsoft-Windows-Windows Defender/Operational log	The computer the attack surface reduction rule runs on	The same rule in audit mode, which is noisy by design, so look for rare processes and ones in user or temporary folders.	An attack surface reduction rule in audit mode
1116 `The antimalware platform detected malware or other potentially unwanted software` (opens in a new tab) Microsoft-Windows-Windows Defender/Operational log	The computer Microsoft Defender Antivirus protects	A detection naming credential theft or a dump of LSASS, with the process and path it came from.	Always written
4656 `A handle to an object was requested` (opens in a new tab) Security log	The computer that holds the object, when the object has a matching audit entry	A handle to lsass.exe asked for with memory read rights, where Audit Kernel Object and an audit entry on LSASS are set.	Audit Kernel Object, and an audit entry (SACL) on the object
4624 `An account was successfully logged on` (opens in a new tab) Security log	The computer that was logged on to	Logon Type 10 or 2 by privileged accounts on servers and workstations, both of which leave reusable credentials there, unless Restricted Admin Mode is Yes.Reading Logon Events explains how to read it.	Audit Logon
3033, 3063, 3065 and 3066 `A code integrity check determines that a process, usually LSASS.exe, attempts to load a driver that doesn't meet the Microsoft signing level requirements` (opens in a new tab) Microsoft-Windows-CodeIntegrity/Operational log	Any Windows computer that runs LSA protection, domain controllers included	3033 or 3063, where a module was refused a load into protected LSASS, a sign of code pushed into it, not of a memory read.	LSA protection on (3033 and 3063 record a refused load) or in audit mode (3065 and 3066)

What It Looks Like

One event from the worked example, decoded field by field, so you can see what to read in it and what each value means.

4624 An account was successfully logged on

In the Security log on srv-fin-01, 14 Oct 2026, 22:16:41 UTC

adm-alice's Remote Desktop sign-in on srv-fin-01, the logon the Registry topic's Remote Desktop history points to.

Remote Desktop, so her password reached srv-fin-01, whose LSASS now holds her NT hash and TGT.
As Windows writes it: Logon Type 10
An admin account. Its secrets on a server are worth more than any file there, so list every machine it signs in to.
As Windows writes it: Account Name adm-alice
A domain account, so its hash and TGT work across the domain, not only here.
As Windows writes it: Account Domain CORP
Where she connected from, the laptop whose Registry holds the matching Remote Desktop history.
As Windows writes it: Workstation Name WS-042
ws-042's address, matching the workstation name.
As Windows writes it: Source Network Address 192.0.2.42
Restricted Admin mode was not used. It, or Remote Credential Guard, keeps an admin's credentials off the server.
As Windows writes it: Restricted Admin Mode No

Blind Spots

Where this attack leaves little or nothing to see, so a quiet log is not read as an all-clear.

Defender for Identity cannot see it, because the read happens inside one machine, so only that machine's own telemetry records it.
Under LSA protection a memory read is refused outright. CodeIntegrity 3033 and 3063 record a module refused a load into LSASS, a different sign.

Look for It on a Machine

The Registry keys on an endpoint that hold a trace of this, each opening its own page.

Hunt It

The query to run in each tool, and how well each one sees this attack. Pick the tool you use, and the others load their query when you open them.

Sees It DirectlyDeviceEvents

Needs the ASR rule in audit or block mode with Defender Antivirus active. Microsoft marks the rule not applicable where LSA protection is on. Many harmless processes ask LSASS for more access than they need, so a hit is an attempt, not proof of theft, and rare processes come first.

KQLDefender XDR, Advanced hunting

// LSASS credential theft blocked or audited by the attack surface reduction ruleDeviceEvents| where Timestamp > ago(30d)| where ActionType in ("AsrLsassCredentialTheftBlocked", "AsrLsassCredentialTheftAudited")| summarize Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName| order by Events asc

How to Prevent It

The controls that break this attack, each with how it helps here and, where the Registry topic has it, where to check it on a machine.

Credential Guard (opens in a new tab)
Turn on Credential Guard, so domain accounts' NT hashes and TGTs sit outside LSASS and a read of its memory finds neither.
Check it on a machine: Credential Guard (LsaCfgFlags)
LSA protection (opens in a new tab)
Run LSASS as a protected process, so even admin code cannot open it to read its memory.
Check it on a machine: LSA Protection (RunAsPPL)
Protected Users group (opens in a new tab)
Add privileged accounts to Protected Users, so they leave no NT hash, password or long-term key in LSASS and their TGTs last four hours.
Remote Credential Guard (opens in a new tab)
Use Remote Credential Guard for admins' Remote Desktop sessions, so their credentials never reach the server.
Check it on a machine: Restricted Admin Mode
Tiered administration (opens in a new tab)
Let admin accounts sign in only to machines of their own tier, so ordinary servers never hold them.
ASR rule for LSASS (opens in a new tab)
Where LSA protection cannot run, turn on the ASR rule, which blocks processes reading LSASS memory.
WDigest off (opens in a new tab)
Keep WDigest off, so it stores no copy of the password in memory.
Check it on a machine: WDigest UseLogonCredential

How the Attack Works

How It Plays Out

Step 1 of 4: Remote Desktop Sign-In

Step 2 of 4: LSASS Memory Read

Step 3 of 4: Dump Taken Away

Step 4 of 4: Secrets Read Out