LSASS Memory
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T15...
BY SOURCE
PROCEDURES (57)
Auto-extracted: 9 detections for dump
Auto-extracted: 8 detections for lsass
Auto-extracted: 6 detections for process access
Auto-extracted: 5 detections for suspicious
Auto-extracted: 4 detections for credential
Auto-extracted: 3 detections for bypass
Auto-extracted: 3 detections for service
Auto-extracted: 3 detections for lsass
Auto-extracted: 3 detections for credential
Auto-extracted: 3 detections for remote thread
Auto-extracted: 2 detections for lsass
Auto-extracted: 2 detections for file monitoring
Auto-extracted: 2 detections for process creation monitoring
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for kerbero
Auto-extracted: 2 detections for lsass
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for registry
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for registry
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for process access
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for powershell