LSASS attack is an attack that targets the Local Security Authority Subsystem Service on Windows. It usually aims to read memory from the process to steal credentials, Kerberos tickets, hashes, or tokens used for logon and lateral movement.
What LSASS attacks target
The Local Security Authority Subsystem Service, or LSASS, is a high-value Windows process because it holds material that can unlock interactive and remote access. An LSASS attack is dangerous precisely because successful memory access can expose reusable authentication material, making the compromise useful long after the initial intrusion.
Attackers typically target LSASS to steal credentials, Kerberos tickets, password hashes, or access tokens. Those artefacts can let them impersonate users, move laterally, or regain access without needing to crack passwords in the usual way.
Why LSASS is such a valuable target
LSASS sits close to the core of Windows logon and token handling, so it often becomes a shortcut to the broader identity environment. If an attacker can read or dump its memory, they may obtain enough material to act as a valid user or service account in other parts of the network.
This is why LSASS attacks are often associated with credential dumping, privilege escalation, and lateral movement. The immediate technical target is one process, but the operational impact can extend to domain access, remote administration, and persistence across multiple hosts.
How organisations assess exposure
Exposure starts with knowing which endpoints and servers have protections around LSASS, which administrative tools can reach them, and where high-value credentials are likely to be loaded. Teams should confirm whether their estate uses security features such as LSASS protection, credential isolation, and telemetry that can show suspicious memory access.
For Windows hardening and telemetry practices, the Windows Internals for Defenders Guide is a useful reference because it covers LSASS protection, token handling, privileges, and the event sources defenders commonly use to spot abuse.
Exposure review should also include privileged workstations, jump hosts, and any systems where administrators regularly sign in with elevated accounts. Those systems tend to concentrate the very credentials an attacker most wants to steal from memory.
Defence, detection, and recovery after compromise
Defence is strongest when LSASS is harder to access and easier to monitor. Practical controls include reducing local administrative exposure, protecting LSASS where the platform supports it, and watching for suspicious handles, memory reads, dump creation, or unusual security tooling that touches the process.
External guidance from CISA cyber threat advisories can help teams correlate LSASS-style credential theft with broader intrusion activity, while MITRE ATT&CK Enterprise Matrix is useful for mapping credential access and lateral movement behaviours to detection logic.
After suspected LSASS compromise, assume credentials, tickets, and tokens that were resident on the affected host may be exposed. Recovery should include reviewing sign-in activity, looking for lateral movement, and rotating or invalidating any accounts, sessions, or secrets that could have been harvested from memory.
Risk and Threat Considerations
LSASS attacks are high impact because they convert a single endpoint compromise into reusable authentication material. That turns one foothold into a broader identity compromise, especially when privileged users or long-lived sessions were present on the host.
Failure mechanism: The attacker reads or dumps LSASS memory and extracts credentials, Kerberos artefacts, or tokens that can be replayed elsewhere in the environment.
Impact: The attacker may impersonate users, escalate privilege, move laterally, and retain access even after the original malware or foothold is removed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | LSASS attacks abuse stolen authenticators and session material. |
| AC-6 — Least Privilege | Reducing privilege limits what LSASS theft can unlock on the host and beyond. | |
| AU-6 — Audit Review, Analysis, and Reporting | LSASS abuse is often detected through review of suspicious endpoint and logon activity. | |
| Recommendation — Rotate exposed authenticators and invalidate harvested sessions after suspected LSASS compromise. Apply least privilege so a compromised endpoint yields fewer reusable administrative credentials. Review endpoint and authentication logs for memory access, dump creation, and lateral movement indicators. | ||
| CIS Controls v8 | CIS-5 — Account Management | LSASS attacks often pivot through privileged accounts and reused sign-in material. |
| Recommendation — Limit privileged account exposure and remove unnecessary local administrator access. | ||
| MITRE ATT&CK | T1003 — OS Credential Dumping | LSASS memory theft is a canonical credential dumping technique. |
| Recommendation — Hunt for credential dumping activity on endpoints and tie alerts to downstream lateral movement. | ||
Practitioner Guidance
What to watch for: Treat LSASS as a control point, not just another process. The most important judgement is whether privileged credentials are being exposed on systems that do not need them, because that changes both the blast radius and the urgency of containment.
Practitioner takeaway: If an attacker can reach LSASS, they may not need to steal passwords at all, they can often steal the session material that already proves who the user is.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org