Attackers use an LSASS dump to extract credentials, hashes, tickets or secrets from the Local Security Authority Subsystem Service process on Windows. They usually obtain the dump after gaining local access or by abusing debugging or crash-dump features. Defenders should restrict dump creation, watch for suspicious access to LSASS, and investigate any unexpected credential material exposed on disk.
What an LSASS dump gives an attacker
An LSASS dump is valuable because LSASS holds material that can be turned into immediate access: plaintext credentials in some cases, password hashes, Kerberos tickets, and other secrets resident in memory. Once an attacker has that dump, they can often move from local execution to broader credential abuse, especially if the same material works across multiple systems or sessions.
The dump is usually a means to an end, not the end itself. Attackers typically create it after they already have code execution on the host, then search the file offline for reusable identity material, ticket material, or privileged session state.
How attackers typically obtain the dump
Most LSASS dumping activity depends on local access and a way to read process memory. Common paths include abusing legitimate crash-dump behavior, using debugging features, or invoking tools that can open LSASS with sufficient rights. In practice, the attacker is trying to get a copy of memory without tripping the normal protections that would block a direct read.
That means the surrounding host state matters as much as the technique. If local admin rights are already present, if LSA protection is disabled or weakened, or if security tooling is not watching process access closely, the dump becomes much easier to produce and exfiltrate. A good technical overview of the technique and the related defensive controls is covered in NHIMG’s Credential Dumping Guide.
What defenders should assume after an LSASS dump
Once LSASS memory is exposed, the defensive problem is broader than one host. The material in the dump can enable pass-the-hash, pass-the-ticket, lateral movement, and reuse of standing privileges on other systems, depending on what the attacker extracted. That is why unexpected LSASS access is treated as a credential exposure event, not just a malware indicator.
Attackers often combine this with other credential access activity, which is why defenders should correlate LSASS access with nearby signs of privilege escalation, suspicious remote logons, and process creation from unusual parent-child chains. NHIMG’s The State of NHI & AI Agent Breach Report 2026 is useful here because it places credential theft and secret exposure in the context of real-world breach patterns and follow-on abuse.
Risk and Threat Considerations
LSASS dumping is high impact because it turns a single local compromise into a credential harvesting opportunity. The main risk is not the dump file itself, but the trust material it can expose, which may let an attacker authenticate elsewhere, impersonate a user or service, or continue moving through the environment after the original foothold is detected.
Failure mechanism: The attacker gains local execution or elevated rights, accesses LSASS memory, and extracts reusable authentication material before defenders notice the unusual process access or file creation.
Impact: Exposed hashes, tickets, or secrets can enable lateral movement, privilege reuse, and repeated authentication attempts that are hard to distinguish from legitimate activity once the dump has left the endpoint.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1003 — OS Credential Dumping | LSASS dumping is a credential-dumping technique used to harvest memory-resident secrets. |
| Recommendation — Map LSASS dump alerts to credential-dumping detections and hunt for follow-on lateral movement. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Suspicious LSASS access requires endpoint monitoring and alerting on process-memory abuse. |
| IA-5 — Authenticator Management | Recovered hashes, tickets, and secrets create immediate credential lifecycle risk. | |
| Recommendation — Monitor endpoints for unauthorized LSASS access, dump creation, and abnormal process behavior. Rotate exposed credentials, tickets, and secrets after any confirmed LSASS dump. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | LSASS dumping is best found through endpoint logging, process telemetry, and alert review. |
| Recommendation — Centralize and review endpoint logs for LSASS access, dump creation, and credential abuse indicators. | ||
Practitioner Guidance
What to verify: Confirm whether the host allows LSASS access by design, whether LSA protection is enabled, and whether your EDR records process access to LSASS, dump file creation, and subsequent archive or transfer activity. Treat the presence of a dump on disk as a compromise indicator until you can prove otherwise.
Escalation / exception: If the dump may contain privileged user, service account, or domain authentication material, escalate as a potential credential compromise event, not a routine malware cleanup. Rotation decisions should follow the exposure, not the certainty of confirmed misuse.
Practitioner takeaway: The key judgement is to think in terms of blast radius, not just detection, because an LSASS dump can remain useful to an attacker long after the original process has been removed.