LSASS dumping: credentials in memory

LSASS handles Windows authentication and keeps session secrets in memory: NT hashes, Kerberos tickets, sometimes cleartext passwords (legacy WDigest).

The dump

With admin privileges you read LSASS memory and extract credentials offline:

procdump -ma lsass.exe lsass.dmp   # Microsoft-signed tool
mimikatz sekurlsa::minidump lsass.dmp + sekurlsa::logonpasswords

EDRs watch LSASS access, so attackers use stealthy techniques (duplicated handles, drivers, dumps via lesser-known APIs).

Defence

Credential Guard isolates secrets in a virtualized environment. LSASS as PPL (RunAsPPL) blocks access from unprotected processes. Disable WDigest. EDR with LSASS protection. Tiering to limit where privileged credentials run.