LSASS Memory Dump

What the dump contains and why it matters

An LSASS memory dump is a captured snapshot of the Windows Local Security Authority Subsystem Service process. Because LSASS handles logon state and related security material, the dump can contain credentials, token material, cached secrets and other reusable authentication data. That makes the file far more sensitive than an ordinary crash artifact.

The security significance is not the dump itself, but what it reveals when the process memory is analysed offline. If the snapshot is protected poorly, it can become a portable source of access material that outlives the original host session and can be examined by an attacker on a separate machine.

How LSASS dumps are created and analysed

Defenders collect LSASS dumps for incident response, memory analysis and credential exposure review. Attackers use the same technique to extract secrets after gaining local execution or elevated access. The operational difference is intent, but the technical object is the same: volatile process memory captured for later inspection.

On Windows, memory acquisition tools and live-response utilities are often used to create the dump, then analysts inspect it with forensic tooling to determine whether authentication material, injected code or suspicious handles were present at the time of capture. Memory Forensics Guide covers this workflow from acquisition through offline analysis.

Because the file is a point-in-time image, the most important question is not just whether it exists, but who can access it and how long it persists. A dump left on disk, copied into a ticket, or stored in a shared location can expose the same secrets long after the original incident.

Why LSASS memory is a high-value target

LSASS sits at the centre of Windows authentication. That makes it attractive because one successful dump can reveal material that supports further access, lateral movement or impersonation without immediately reusing the original host. In practice, the value comes from scale, one process snapshot can expose multiple reusable secrets at once.

Attackers commonly pursue LSASS dumping after they have local code execution, then use the extracted material to move from one account to another or from one system to another. For that reason, defenders often treat LSASS exposure as both a credential theft issue and a broader intrusion indicator. The ATT&CK view of Credential Access helps place LSASS dumping in the wider attack chain.

The risk is amplified when organisations rely on the same privileged sessions, service accounts or admin logons across many systems. A single dump can then unlock more access than the original compromise would suggest.

Protection, detection and response priorities

LSASS should be treated as a protected trust boundary, not just another process. Practical controls include reducing who can read process memory, hardening Windows protections around LSASS, and limiting where credential material can exist in the first place. Windows Internals for Defenders Guide is useful when you need to understand the process, privileges and protections that shape LSASS exposure.

Detection should focus on suspicious access to LSASS, abnormal dump creation tools, unusual handle patterns and post-dump behaviour such as archive creation, staging or outbound transfer. When a dump is discovered, the response question is not only whether the host is clean, but whether reusable authentication material may already have been taken and used elsewhere.

That is why incident handling often extends beyond the endpoint to credential and session review. Sysinternals for Incident Responders Guide is relevant when validating suspicious process activity and live response evidence, while Credential Dumping Guide provides the broader defensive context around LSASS, related secrets and post-exploitation review.

Risk and Threat Considerations

LSASS dumping is dangerous because it converts live authentication state into offline, reusable material. Once the dump is copied, the attacker no longer needs continued access to the original machine to mine credentials, secrets or session-related artefacts.

Failure mechanism: An attacker with sufficient local access or execution rights captures LSASS memory, then analyses the file offline to extract authentication material that can be reused for further access or lateral movement.

Impact: Credential exposure can lead to account compromise, privilege escalation, session abuse and broader domain spread, especially when the stolen material belongs to privileged users or service accounts.

Related resources from NHI Mgmt Group

• Memory Dump
• What happens when an attacker can dump LSASS memory or read Group Policy files in Active Directory?
• What breaks when attackers can dump LSASS memory before ransomware starts?
• What are the signs that a memory dump may contain hidden malicious code?