LsaIso.exe

Credential Guard's Isolated LSA

Credential Guard's isolated LSA, which runs only while Credential Guard runs.

Normal Processes
Open it in the tree

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent: wininit.exe (a value that published detection rules check for)Source: Elastic: Unusual Parent-Child Relationship (opens in a new tab)
Path: System32 (a value that published detection rules check for)C:\Windows\System32\LsaIso.exeSources: SigmaHQ: System File Execution Location Anomaly (opens in a new tab), Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab)
Account: Read it from the token on a clean machine of the same build, with Get-Process -IncludeUserName live or windows.getsids in memory.
Session: Read its SessionId with Get-CimInstance Win32_Process, or windows.pslist in memory, on a clean machine of the same build.
Instances: Count copies on a clean machine of the same build and set-up, with Credential Guard confirmed running.None where Credential Guard is off, and Pro runs it only on a device that ran it before a downgrade.
Starts: WinInit event 13 in the System log records that it started at boot, so compare its start with lsass.exe's.
Command Line: Read it elevated with Get-CimInstance Win32_Process, or windows.cmdline in memory, and compare with a clean machine of the same build.
Signed By: The binaries it hosts are signed with a certificate VBS trusts and checked before they start, and Sigcheck confirms the file.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

Where it runs, the secrets Credential Guard protects sit in memory that admin code and debuggers cannot read and memory dumps do not hold. Where Credential Guard should run but does not, as WinInit event 15 in the System log records, those secrets sit in lsass.exe instead.

What It Does

With Credential Guard on, lsass.exe talks over RPC to the isolated LSA process, LsaIso.exe, which stores the secrets Credential Guard protects in memory walled off by virtualisation-based security (VBS). It hosts no device drivers, only a small set of Windows binaries signed with a certificate VBS trusts and checked before they start. It is started at boot by wininit.exe where Credential Guard runs, and WinInit event 13 in the System log records that start. Whether Credential Guard runs is read from System Information or the WinInit events, not from the process list. A copy outside System32, or one on a machine where those checks say Credential Guard is off, is the odd thing to look for.

It runs as a trustlet, a process in isolated user mode. Microsoft says no debugger can attach to it, post-mortem debugging of memory dumps included, and that loading a DLL into it or starting a thread in it does not work. Even a compromised Windows kernel cannot read its pages, so a memory image taken from inside Windows does not hold the secrets it keeps.

Credential Guard runs on Enterprise and Education editions, while Pro and Pro Education run it only if the device ran it before a downgrade. It needs VBS and, in a Hyper-V virtual machine, generation 2 on a host with an IOMMU. From Windows 11 version 22H2 and Windows Server 2025 it is on by default on domain-joined devices that are not domain controllers and meet the requirements, unless it was turned off before the update.

Microsoft says not to judge Credential Guard by whether LsaIso.exe shows in Task Manager. Check System Information, Win32_DeviceGuard's SecurityServicesRunning, or the WinInit events in the System log instead. Event 13 says LsaIso.exe started, and event 15 says Credential Guard was configured but the secure kernel was not running.

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

Malware takes the name LsaIso.exe and runs from a folder other than System32, or on a boot with no WinInit event 13 to explain it.Wrong Path

Red Flags

Each sign below links to the page that shows how to confirm it.

Any parent but wininit.exe.Wrong Parent
Any folder but System32.Wrong Path
A copy on a boot with no WinInit event 13 to explain it. Find what started it, and from which folder.Extra or Missing Instances
A file that fails its signature check, since a genuine copy is signed with a certificate VBS trusts.Renamed, Unsigned or Falsely Signed Binaries

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It Lands	What to Read	How to Turn It On
13 `Credential Guard (LsaIso.exe) was started and will protect LSA credentials` (opens in a new tab)`System`It is written on a computer running Credential Guard. Its source is WinInit.	Written at boot when LsaIso.exe started and will protect LSA credentials.	On by default
15 `Credential Guard (LsaIso.exe) is configured but the secure kernel isn't running; continuing without Credential Guard` (opens in a new tab)`System`It is written on a computer set to run Credential Guard whose secure kernel did not start. Its source is WinInit.	Credential Guard was set to run but the secure kernel did not start, so lsass.exe holds the secrets after all.	On by default
`DeviceProcessEvents` (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced hunting	FileName LsaIso.exe with an InitiatingProcessFileName other than wininit.exe, or a FolderPath outside System32.	The Defender for Endpoint sensor on the device
1 `Process creation` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	Image LsaIso.exe with a ParentImage other than wininit.exe.Process Trees and Call Chains shows how to read it.	Run Sysmon with ProcessCreate events in its configuration.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents, with DeviceFileCertificateInfo

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, so it holds only copies started while the sensor ran. Check that a recent boot shows the genuine copy before you read no rows as clean. A hit is a lead until its file and creator are checked. A blank signature means unknown, not unsigned, because DeviceFileCertificateInfo holds only files the sensor has checked.

KQLDefender XDR, Advanced hunting

// LsaIso.exe copies whose parent, path or signature breaks its profileDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "LsaIso.exe"| join kind=leftouter (    DeviceFileCertificateInfo    | summarize arg_max(Timestamp, IsSigned, IsTrusted, Signer, SignatureType) by SHA1    ) on SHA1| where InitiatingProcessFileName !~ "wininit.exe"    or FolderPath !in~ (@"C:\Windows\System32\LsaIso.exe", @"C:\Windows\System32")    or IsTrusted == false| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, IsSigned, IsTrusted, Signer, SignatureType| order by Timestamp desc

Changes by Version

This process has changed between versions, so read a machine against its own.

Windows 11 version 22H2 On by default on eligible domain-joined devices that are not domain controllers, without UEFI lock.
Windows Server 2025 The same default for domain-joined servers that are not domain controllers.