Detecting LSASS credential dumps in Windows event logs
Once an attacker is on a Windows machine, dumping credentials is usually one of the first things they do. The target is almost always lsass.exe, the Local Security Authority Subsystem Service. LSASS holds NTLM hashes, Kerberos tickets, and sometimes plaintext passwords for the users who have logged on to that machine. With those in hand, an attacker can often move laterally to other machines in the domain.
A dump takes seconds, and if you aren't collecting the right events there will be nothing to show it happened. Below are five common ways attackers dump credentials and the Windows events that record each one.
Mimikatz (sekurlsa::logonpasswords)
Mimikatz is the best-known credential dumping tool. It reads LSASS memory directly to pull out hashes and tickets. On a machine with Sysmon installed, you'll see Event ID 10 (ProcessAccess) where the TargetImage is C:\Windows\System32\lsass.exe and the GrantedAccess mask includes 0x1010 or 0x1FFFFF (PROCESS_ALL_ACCESS). Without Sysmon, look for Event ID 4656 (handle requested) and Event ID 4663 (object access) in the Security log targeting lsass.exe with READ_CONTROL or PROCESS_VM_READ access. A non-system process opening a handle to LSASS with those permissions should be investigated.
comsvcs.dll MiniDump
Attackers who want to avoid dropping Mimikatz on disk use a built-in Windows DLL instead. The command rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump [lsass PID] out.dmp full creates a full memory dump of LSASS using a signed Microsoft binary. Look for Event ID 4688 (process creation) where the command line contains both "comsvcs" and "MiniDump", or where rundll32.exe is started with comsvcs.dll as an argument. Because rundll32 and comsvcs.dll are both legitimate Windows files, the command line is what you alert on. This is a typical living-off-the-land technique.
ProcDump (Sysinternals)
ProcDump is a legitimate Sysinternals tool, which is part of why attackers use it for credential theft. The command procdump.exe -ma lsass.exe lsass.dmp writes LSASS memory to a file that can be copied off the machine and parsed offline with Mimikatz. Watch for Event ID 4688 where the new process name contains "procdump" and the command line references "lsass". If you run Sysmon, also check Event ID 11 (FileCreate) for .dmp files created in unusual places such as temp directories or user profiles.
Task Manager dump
This one needs no extra tools, only a GUI session and local admin rights. The attacker opens Task Manager, right-clicks lsass.exe, and selects "Create dump file." Windows writes the dump to the user's AppData\Local\Temp folder. Look for Event ID 4688 where taskmgr.exe spawns a child process, together with Event ID 4663 showing a file write to a path ending in lsass.DMP.
Registry SAM extraction
Instead of touching LSASS, an attacker can save the SAM, SYSTEM and SECURITY registry hives and extract credentials from them offline: local account hashes from SAM, and cached domain logon hashes and LSA secrets from SECURITY. The commands reg save HKLM\SAM sam.bak and reg save HKLM\SYSTEM sys.bak are easy to spot in Event ID 4688 process creation logs. Also watch for Event ID 4656 where ObjectName contains \REGISTRY\MACHINE\SAM or \REGISTRY\MACHINE\SECURITY with write or backup access. This approach skips LSASS entirely, so it won't show up in LSASS access events.
Most of these techniques open a handle to lsass.exe with unusual access rights, start a process with LSASS-related command-line arguments, or write a .dmp file to disk, and the registry method shows up in its own command line. If you audit process creation (Event ID 4688 with command-line logging turned on) and object access (4656/4663), you have the raw data to spot all five.
In practice these events are easy to miss among thousands of routine log entries. Arden has detection rules for credential dumping activity, including suspicious access to LSASS, and raises an alert when one of them matches on a monitored host. It won’t catch every variant, so treat a lack of alerts as “nothing matched” rather than proof that nothing happened.
Stolen credentials are usually used next for lateral movement, which we cover in spotting lateral movement without a SOC. For the basics, start with the 5 Windows Event IDs every system administrator should monitor. If you’re comparing detection tools, our post on flat-rate server monitoring looks at the cost side.
Get alerted to credential dumping
Arden has detection rules for LSASS dumping, Mimikatz-style credential access, pass-the-hash and Kerberoasting, and alerts you when one of them matches on a machine you've added.
Request a Beta Invite