Credential Dumping Guide: LSASS, NTDS.dit and Mimikatz

Credential dumping turns one compromised host into many, because the hashes, tickets and cleartext secrets that Windows and Linux keep for convenience are exactly what an attacker needs to log on somewhere else. MITRE ATT&CK tracks it as OS Credential Dumping (T1003), with eight sub-techniques covering LSASS memory, the SAM, NTDS.dit, LSA secrets, cached domain credentials, DCSync and two Linux stores. This guide is for SOC analysts, detection engineers and the Windows, Active Directory and endpoint teams who have to stop it. It describes each store only at the level of the ATT&CK descriptions, then concentrates on prevention, telemetry, response and which credentials to rotate. It contains no attack procedures.

Key takeaways

• Dumping needs privilege first. Every Windows sub-technique assumes local administrator or SYSTEM, or replication rights for DCSync, so removing standing admin rights and debug privilege shrinks the attack more than any detection.
• Protect LSASS in layers. LSA protection (RunAsPPL) and Credential Guard are the primary controls, the Defender ASR rule is the fallback, and WDigest must stay off.
• Domain controllers are a different problem. Credential Guard does not protect NTDS.dit, so DC defence means tightly held replication rights, protected backups, tiering and 4662 auditing.
• Detect the access, not the tool name. A non-security process opening lsass.exe, a dump file, a shadow copy on a DC or replication from a non-DC host survive tool renaming.
• Response is a rotation exercise. Every credential the store held is burned: service accounts in LSA secrets, local admins, logged-on administrators and, after NTDS theft or DCSync, krbtgt, reset twice.

Where credentials live and what dumping leaves behind

ATT&CK defines the technique as follows: "Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password." The material then feeds Pass the Hash (T1550.002), Pass the Ticket (T1550.003) and Golden Ticket forgery (T1558.001). Knowing what each store holds decides both the control and the rotation scope.

ATT&CK notes that DCC2 hashes cannot be used for pass the hash and must be cracked, while LSASS and NTDS material can often be reused directly. LSA secrets is where Windows keeps passwords of services running as domain accounts, so every server with such a service is a source of non-human credentials.

Tools defenders will see named in alerts

The table maps common tools to their ATT&CK software entry so analysts can look up full technique coverage. Detect the behaviour in the last column; names and hashes change trivially.

ATT&CK also records abuse of the built-in comsvcs.dll and the Windows Error Reporting silent process exit mechanism to write LSASS dumps, so the dumping binary may be Microsoft-signed. Adjacent techniques include Credentials In Files (T1552.001), Credentials in Registry (T1552.002), Credentials from Web Browsers (T1555.003), Credential API Hooking (T1056.004), Network Provider DLL (T1556.008, demonstrated by proof-of-concept tools such as NPPSpy) and Domain Controller Authentication (T1556.001, the "skeleton key" LSASS patch on DCs). LSA protection and DC hardening reduce most of them.

Protecting LSASS on workstations and member servers

• LSA protection (RunAsPPL): runs LSASS as a protected process so non-protected processes cannot read its memory or inject code. Set RunAsPPL under HKLM\SYSTEM\CurrentControlSet\Control\Lsa to 1 (UEFI lock) or 2 (no lock, Windows 11 22H2 and later), or use "Configures LSASS to run as a protected process" under Administrative Templates > System > Local Security Authority, or the Intune setting LocalSecurityAuthority/ConfigureLsaProtectedProcess. It is default only on new, enterprise-joined, HVCI-capable Windows 11 22H2 installs, not upgrades. Verify with WinInit event 12 ("LSASS.exe was started as a protected process with level: 4").
• Credential Guard: uses virtualisation-based security to isolate NTLM hashes, Kerberos TGTs and application-stored domain credentials in LSAIso.exe. Default on for qualifying Windows 11 22H2 and domain-joined Windows Server 2025 non-DC systems, without UEFI lock. Needs Enterprise or Education licensing, VBS, Secure Boot and Generation 2 VMs. It breaks Kerberos DES, unconstrained delegation and NTLMv1, and applications needing Digest, CredSSP, credential delegation or MS-CHAPv2 still expose credentials.
• ASR rule: "Block credential stealing from the Windows local security authority subsystem" (9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2). Microsoft says it adds no protection where LSA protection is on, so use it on devices that cannot run RunAsPPL, usually because of unsigned LSA plug-ins. It needs Defender Antivirus in active mode and has no Warn mode.
• WDigest off: when enabled, WDigest keeps cleartext passwords in LSASS. Keep UseLogonCredential under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest at 0 and alert on any change to 1. ATT&CK M1028 also recommends restricting NTLM.
• Remove debug privilege: reading another process's memory needs SeDebugPrivilege, granted by the "Debug programs" user right (Administrators by default). Restrict it by policy and alert on event 4672 showing it for unexpected accounts.
• Limit cached logons: lower "Interactive logon: Number of previous logons to cache" from its default of 10 to 0 or 1 on servers and fixed desktops; keep a small value on laptops.
• Unique local administrator passwords: Windows LAPS rotates each device's local administrator password and backs it up to Entra ID or AD, so one SAM hash opens nothing else. See the Windows Endpoint Hardening Guide.

Choosing the LSASS control

Small organisations without Enterprise licensing get most of the benefit from LSA protection, Windows LAPS, WDigest off and no daily admin rights. Large estates should add Credential Guard and treat a device reporting RunAsPPL off as non-compliant. See the EDR Evasion and Defence Guide for driver attacks on protected processes.

Protecting domain controllers, NTDS.dit and replication rights

Microsoft states that Credential Guard "doesn't provide protections for the Active Directory database or the Security Accounts Manager (SAM)". Losing NTDS.dit or allowing DCSync is a full domain compromise, so DC protection is about who can reach the data at all.

• Restrict replication rights: ATT&CK M1015 is to manage the ACL for "Replicating Directory Changes" and "Replicating Directory Changes All" (rights GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2, which "allows the replication of secret domain data"). Legitimate holders are DCs, the built-in administrative groups and, with password hash synchronisation, the Entra Connect sync account. Anything else is a finding.
• Tiered administration: per M1026, Domain Admins log on only to DCs and privileged access workstations, never to workstations or member servers where their credentials land in LSASS. Enforce with "Deny log on" user rights. See the Active Directory and Entra ID Hardening Guide.
• Protected Users: members get no CredSSP or WDigest plaintext caching, no cached NTLM hashes, no DES or RC4 keys, no offline sign-in, and at the DC no NTLM, no delegation and a four-hour TGT. It needs domain functional level 2012 R2 or later and AES keys. Never add service or computer accounts, and add administrators in stages to avoid lockout.
• Secure DC backups: M1041. Backups hold the same data as NTDS.dit, so encrypt them and treat backup consoles and hypervisors hosting virtual DCs as tier 0.
• LSA protection on DCs: also hardens against LSASS patching. Audit plug-ins first with AuditLevel 8 and CodeIntegrity events 3065 and 3066, since password filters load there.

Linux and non-Windows credential stores

• /etc/shadow: root-readable only; alert on reads or copies by anything except authentication services and package managers, using file integrity monitoring or an auditd watch.
• Process memory: set kernel.yama.ptrace_scope to 2 (admin only) or 3 (no attach) on servers, mount /proc with hidepid, and alert on /proc/<pid>/mem access to sshd, login or keyring daemons.
• SSSD caches: limit cached credentials on AD-joined hosts that always reach a DC.
• Root is the prerequisite: tight sudo rules, unique root passwords and no shared root keys do most of the work. See the Password Security Guide.

Detection and measurement

ATT&CK's T1003 detection strategies describe sequences: an unusual process reaches a credential store, then writes a file or moves laterally. Build analytics on that chain. See the Detection Engineering Guide and the Windows Event Log Guide.

Event 4662 fires only when a SACL on the object matches, so add a Control Access audit entry on the domain root and confirm events arrive. ITDR tools such as Microsoft Defender for Identity watch replication traffic directly. See the ITDR Guide.

Honey credentials: plant decoys where dumping will find them, such as a fake privileged account cached on selected servers or a decoy service account in LSA secrets. With no legitimate use, any 4624, 4625 or Kerberos request for it is a high-fidelity sign that a store was dumped.

Metrics:

• Share of Windows devices reporting LSASS protected (WinInit 12) and Credential Guard running.
• Accounts other than DCs and the sync account holding replication rights (target: zero).
• Tier 0 logons to workstations or member servers per month (target: zero).
• Share of devices with a successful Windows LAPS rotation in the last 30 days.
• Time from LSASS access or 4662 alert to triage, tested by purple team exercises.

Implementation: a phased rollout

1. Inventory: who holds local admin, debug privilege and replication rights, where tier 0 accounts log on, and which LSA plug-ins load on each build.
2. Quick wins: confirm WDigest off, deploy Windows LAPS, remove domain accounts from local Administrators, remove unexpected replication rights.
3. LSA protection in audit: AuditLevel 8 on a pilot ring; review CodeIntegrity 3065 and 3066 and fix plug-ins.
4. Enforce in rings: RunAsPPL value 2 on pilot, then broad rings; ASR rule in block where RunAsPPL cannot run. Microsoft notes the rule is noisy in audit and allows going straight to block on a small set.
5. Credential Guard: enable after testing NTLMv1, unconstrained delegation and DES dependencies. Add UEFI lock once a patch cycle passes cleanly.
6. Tier 0: logon restrictions, staged Protected Users, encrypted DC backups, 4662 auditing.
7. Detection: deploy the analytics, plant honey credentials and test with a controlled exercise.

Rollback: without UEFI lock, set RunAsPPL to 0 or the policy to Disabled and reboot; Not Configured does not turn it off. With UEFI lock, Microsoft's LsaPplConfig.efi opt-out tool is needed, which is why the lock comes last. ASR rules revert to Audit or Off.

Responding to confirmed credential dumping

Treat a confirmed dump as theft of everything the store held. See the Incident Response Guide.

1. Scope the store: LSASS exposes accounts with sessions on the host, so list every 4624 logon since its last reboot. SAM exposes local accounts, LSA secrets exposes configured service accounts, and NTDS theft or a 4662 DCSync hit from a non-DC exposes every domain account.
2. Contain first: isolate hosts and remove persistence, or new passwords are captured again.
3. Rotate by exposure: force LAPS rotation; reset service accounts from LSA secrets and privileged users with sessions on the host; after NTDS or DCSync, reset all domain accounts in priority order (tier 0, services, users) and DSRM passwords.
4. Reset krbtgt twice: Microsoft's guidance is "You should perform this operation twice. You must wait 10 hours between password resets", because krbtgt keeps two passwords in history and 10 hours is the default maximum ticket lifetime. RODC krbtgt accounts are separate.
5. Hunt for reuse: logons by exposed accounts from new sources, Golden Ticket indicators, and replication rights or group memberships added during the intrusion. See the Lateral Movement Guide.

Where identity fits

Credential dumping is largely a harvest of non-human credentials. LSA secrets hold passwords of services and scheduled tasks running as domain accounts, often long-lived and highly privileged; move them to group managed service accounts, whose passwords AD rotates. krbtgt is the most powerful NHI in any domain, and the Entra Connect sync account holds replication rights by design, making its server tier 0. In the Storm-0501 hybrid cloud attacks, credential harvesting with Impacket's SecretsDump helped the group reach Domain Admin and extract the plain text credentials of the Entra Connect sync accounts, which Microsoft warned can set or change the Entra ID password of any hybrid account. See the Service Account Security Guide.

Threat-to-control and framework mapping

Common failure patterns

• Domain admins on workstations: one help-desk session leaves privileged credentials in LSASS on an exposed device. Tiering fixes this; detection only reports it.
• Rotating users but not service accounts or krbtgt: in the Cisco Active Directory credentials leak, NTLM hashes reportedly including service, machine and krbtgt accounts were published in 2025 from a 2022 intrusion. Dumped hashes stay valuable until each account is rotated.
• Assuming Credential Guard protects DCs: it covers neither NTDS.dit nor the SAM.
• Rolling back with Not Configured: for LSA protection this leaves the previous setting in place. Verify with WinInit event 12.
• Project replication rights never removed: backup, sync or migration tools left with Replicating Directory Changes All give DCSync to whoever compromises them.
• Detection keyed on tool names: renamed binaries and built-in DLLs bypass it.

Practitioner checklist

• Enable LSA protection everywhere after auditing plug-ins; verify with WinInit event 12.
• Enable Credential Guard on supported non-DC devices, not on DCs or Exchange.
• Use the ASR LSASS rule in block where RunAsPPL cannot run.
• Keep WDigest off and alert on UseLogonCredential changes.
• Restrict "Debug programs", remove domain accounts from local Administrators and deploy Windows LAPS.
• Review replication rights quarterly and audit them with 4662.
• Enforce tier 0 logon limits, stage Protected Users and encrypt DC backups.
• Monitor LSASS access, dump files and DC shadow copies, and plant honey credentials.
• Harden Linux with ptrace_scope, hidepid and auditd watches on /etc/shadow.
• Keep a rotation playbook including a double krbtgt reset.

Standards and references

• MITRE ATT&CK: OS Credential Dumping (T1003)
• MITRE ATT&CK: OS Credential Dumping: LSASS Memory (T1003.001)
• MITRE ATT&CK: OS Credential Dumping: DCSync (T1003.006)
• Microsoft Learn: Credential Guard overview
• Microsoft Learn: Configure added LSA protection
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Protected Users security group
• Microsoft Learn: AD forest recovery, resetting the krbtgt password

Related NHI Mgmt Group resources: Lateral Movement Guide · ITDR Guide · Active Directory and Entra ID Hardening Guide · Secrets Management Guide · Privileged Access Management Guide