lsass.exe: Windows Processes

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent: wininit.exe (a value that published detection rules check for)Source: Elastic: Unusual Parent-Child Relationship (opens in a new tab)LsaIso.exe, the isolated LSA that Credential Guard runs, has the same parent.
Path: System32 (a value that published detection rules check for)C:\Windows\System32\lsass.exeSources: SigmaHQ: System File Execution Location Anomaly (opens in a new tab), Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab)
Account: No public source states it, so read it on a clean machine of the same Windows build and expect every lsass.exe you check to match. Get-Process -IncludeUserName shows it live from an elevated session, and windows.getsids shows it in a memory image.
Session: 0Source: Microsoft Learn: Credentials processes in Windows authentication (opens in a new tab)
Instances: No public source gives a count, so count the copies on a clean machine of the same Windows build and expect the same number here. Get-Process lsass lists them live, and windows.pslist lists them in a memory image.An lsass.exe whose parent is lsass.exe is a clone, which Elastic treats as a sign of credential dumping.
Starts: Compare with wininit.exe's start and the last full boot, as Fast Startup keeps the kernel session through each shutdown.
Command Line: Read it elevated with Get-CimInstance Win32_Process, or windows.cmdline in memory, and compare with a clean machine of the same build.
Signed By: Check the file with Sigcheck or Get-AuthenticodeSignature, because many Windows files are signed through a catalogue, not in the file itself.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

Credential theft goes after its memory, so anything that opens it, loads into it or copies it deserves a look. Whether Credential Guard and added LSA protection run decides how much of it another process can read.

What It Does

The Local Security Authority checks sign-ins, local and remote, and enforces local security policy, and lsass.exe is its process. It keeps the credentials of every session still open in its memory, in several forms, for single sign-on. That lets a person reach file shares and other network resources without typing their credentials again for each one. wininit.exe starts it during boot. Plug-ins load into it as DLLs, such as security support providers, password filters, and smart card and cryptographic plug-ins. A process that opens it to read its memory, a module Windows does not ship loaded into it, or a second copy is the odd thing to look for.

With Credential Guard on, lsass.exe talks over RPC to the isolated LSA process, LsaIso.exe, which stores and protects the secrets Credential Guard covers, such as NTLM hashes and Kerberos ticket-granting tickets (TGTs). Credential Guard runs on Enterprise and Education editions, and from Windows 11 version 22H2 is on by default on eligible domain-joined devices.

With added LSA protection, lsass.exe runs as a protected process. Processes that are not protected cannot read its memory or inject code into it, no debugger can attach, and each plug-in must carry a Microsoft signature. It is on by default only on new, enterprise-joined installs of Windows 11 version 22H2 or later that can run hypervisor-protected code integrity (HVCI).

WinInit event 12 in the System log says lsass.exe started protected. Audit mode for added LSA protection is on by default from Windows 11 version 22H2. Events 3065 and 3066 in Microsoft-Windows-CodeIntegrity/Operational name a plug-in or driver that would fail its rules, and events 3033 and 3063 in the same log one that was refused once protection is on.

Two settings change what lsass.exe holds and who can read its memory, and an audit mode reports what the second would block. This table shows where each is on by default and what you see on a machine that runs it, so you know which kind of lsass.exe you are looking at before you judge it.

What Changes What lsass.exe Holds and Who Can Read It

Setting	Where It Is Enabled by Default	What You See
Credential Guard	Windows 11 version 22H2 and later, on eligible domain-joined Enterprise and Education devices	LsaIso.exe beside lsass.exe, and WinInit event 13 in the System log at boot
Added LSA protection	New installs of Windows 11 version 22H2 or later that are enterprise joined and able to run HVCI	WinInit event 12 in the System log at boot, and a dump of lsass.exe or a debugger is refused
LSA protection audit mode	Windows 11 version 22H2 and later	Events 3065 and 3066 in Microsoft-Windows-CodeIntegrity/Operational for plug-ins that would fail

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

A tool opens lsass.exe with the right to read its memory, to copy the credentials it keeps for open sessions.Handles, Pipes and Mutexes
An extra plug-in, such as a password filter, loads into lsass.exe from a DLL Windows does not ship or Microsoft did not sign.Unsigned or Oddly Signed Modules

In the Process Tree

These are the rows of the process list that this page explains.

lsass.exeLocal Security AuthorityOpen it in the tree: lsass.exe

On ws-042, 12 Oct 2026

lsass.exeLocal Security AuthorityOpen it in the tree: lsass.exe

Red Flags

Each sign below links to the page that shows how to confirm it.

A second lsass.exe, or one whose parent is lsass.exe, which is a clone made to read its memory.Extra or Missing Instances
Any parent but wininit.exe.Wrong Parent
Any folder but System32.Wrong Path
A module loaded into it with no valid signature, or an LSA plug-in Windows does not ship.Unsigned or Oddly Signed Modules
A thread another process started in it, or executable memory no file backs.Remote Thread Injection

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It Lands	What to Read	How to Turn It On
10 `ProcessAccess` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	For TargetImage lsass.exe, SourceImage and GrantedAccess show who opened it and with which rights.Handles, Pipes and Mutexes shows how to read it.	Run Sysmon with ProcessAccess events in its configuration, filtered to the accesses that matter.
`OpenProcessApiCall` (opens in a new tab)A process opened a handle to another process, such as lsass.exe.`DeviceEvents`Defender XDR, advanced hunting	Rows whose FileName is lsass.exe, with the InitiatingProcessFileName that opened it.	The Defender for Endpoint sensor on the device
7 `Image loaded` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	Image lsass.exe with an ImageLoaded whose Signed is false or whose Signature is unexpected.Loaded DLLs shows how to read it.	Run Sysmon with ImageLoad events in its configuration. They are off by default.
12 `LSASS.exe was started as a protected process with level: 4` (opens in a new tab)`System`It is written on a computer whose lsass.exe started as a protected process. Its source is WinInit.	Written at each boot when lsass.exe starts protected, so its absence means it ran unprotected.	On by default
3033 `A code integrity check determines that a process, usually LSASS.exe, attempts to load a driver that doesn't meet the Microsoft signing level requirements` (opens in a new tab)`Microsoft-Windows-CodeIntegrity/Operational`It is written on any computer that runs lsass.exe as a protected process.	A plug-in or driver lsass.exe refused under LSA protection for its signing level. Find who installed it, and why.Loaded DLLs shows how to read it.	Turn on added LSA protection, which then refuses the plug-in or driver.
`AsrLsassCredentialTheftAudited, AsrLsassCredentialTheftBlocked` (opens in a new tab)The attack surface reduction (ASR) rule that locks down lsass.exe fired, in audit or block mode.`DeviceEvents`Defender XDR, advanced hunting	The ASR rule that guards lsass.exe fired, naming the process it blocked, or in audit mode would have blocked.	The Defender for Endpoint sensor on the device

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents, with DeviceFileCertificateInfo

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, so it holds only copies started while the sensor ran. Check that a recent boot shows the genuine copy. A blank signature means unknown, not unsigned. An lsass.exe started by lsass.exe is a clone, a sign of credential dumping. Elastic's clone rule reads event 4688 in the Security log, and Microsoft's page for this table does not say it records a clone, so check 4688 too.

KQLDefender XDR, Advanced hunting

// lsass.exe copies whose parent, path or signature breaks its profileDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "lsass.exe"| join kind=leftouter (    DeviceFileCertificateInfo    | summarize arg_max(Timestamp, IsSigned, IsTrusted, Signer, SignatureType) by SHA1    ) on SHA1| where InitiatingProcessFileName !~ "wininit.exe"    or FolderPath !in~ (@"C:\Windows\System32\lsass.exe", @"C:\Windows\System32")    or IsTrusted == false| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, IsSigned, IsTrusted, Signer, SignatureType| order by Timestamp desc

Changes by Version

This process has changed between versions, so read a machine against its own.

Windows 8.1 Added LSA protection can run lsass.exe as a protected process.
Windows 11 version 22H2 LSA protection audit mode on by default, and protection itself on by default for new, enterprise-joined installs able to run HVCI.
Windows 11 version 22H2 Credential Guard on by default on eligible domain-joined devices, so secrets move to LsaIso.exe.

Check It in the Registry: LSA Protection (RunAsPPL)Credential Guard (LsaCfgFlags)LSA Packages WDigest UseLogonCredential
Read with Active Directory: Credentials on a Running Machine What lsass.exe keeps for each open session, and what Credential Guard moves out of it.
LSASS Memory Theft How credentials are read out of its memory, and what that leaves behind.
Skeleton Key A change to lsass.exe's memory on a domain controller, which windows.malware.skeleton_key_check looks for.