T1003.001 — LSASS Memory

Tactic: Credential Access · Platforms: Windows

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested…

Sub-technique of OS Credential Dumping (T1003).

Sigma detection rules (1)

T1003.001 OS Credential Dumping: LSASS Memory - Suspicious Process Access to LSASS

title: "T1003.001 OS Credential Dumping: LSASS Memory - Suspicious Process Access to LSASS"
id: 1dc98524-c3bf-44bc-a632-67a817f54757
status: test
description: 'Detects process access requests to lsass.exe with a GrantedAccess mask consistent with credential-dumping tools (e.g. Mimikatz, ATPMiniDump) rather than routine reads by AV/EDR. Based on the well-known ''suspicious GrantedAccess flags on LSASS'' pattern (CAR-2019-04-004).'
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Shahrukh Khan
date: 2026-07-10
license: MIT
tags:
  - attack.credential-access
  - attack.t1003.001

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    TargetImage|endswith: '\lsass.exe'

  suspicious_access:
    GrantedAccess|contains:
      - '0x1010'
      - '0x1038'
      - '0x1400'
      - '0x1410'
      - '0x1438'

  condition: selection and suspicious_access

falsepositives:
  - AV/EDR products reading LSASS memory (Windows Defender, CrowdStrike, etc.) — tune with a filter on SourceImage

level: high

Related sub-techniques

Explore