LSASS Memory Credential Dump Response
Executes triage, evidence acquisition, isolation, exposed credential rotation, and hardening steps when suspicious access to lsass.exe, an LSASS dump file, or a credential dumping tool is detected on an endpoint.
MiniDumpWriteDump API directly or custom process-access techniques instead of Mimikatz. Enabling Windows Credential Guard and PPL (Protected Process Light) significantly impedes memory dumping; verify the status of these protections on affected systems. Sysmon Event ID 10 (ProcessAccess to lsass.exe) provides a comprehensive signal regardless of which tool was used.Prepare
4 steps- Telemetry verification
Periodically verify that Sysmon ProcessAccess (EID 10), CreateRemoteThread (EID 8), ImageLoaded (EID 7), FileCreate (EID 11), and ProcessCreate (EID 1) events are being collected; and that 4662 and 4624 auditing is enabled on DCs
- Detection rules deployment status
Confirm that LSASS access mask rules (GrantedAccess 0x1010/0x1410/0x1438/0x143a/0x1F3FFF/0x1FFFFF/0x0040) are actually deployed and tuned; this playbook depends on live rules
- Interactive session hygiene policy
Verify that RDP/RunAs restrictions for privileged accounts and disconnected session termination GPOs have been pre-defined
- Escalation chain
Document the SOC L1 → L2/IR analyst → AD administrator → CISO chain; scope and containment decisions cannot be made by L1 alone
Detect & Analyze
5 steps- Alert validation and triage
In EID 10, evaluate `TargetImage=lsass.exe` and the `GrantedAccess` mask: `0x1010`/`0x1410` → Mimikatz `sekurlsa::*`; `0x1438`/`0x143a` → `lsadump::lsa`/`memssp`/`skeleton`; `0x1F3FFF` → SharpDump; `0x1FFFFF`/`0x1F1FFF` → ProcDump/Task Manager; `0x0040` → handle duplication/nanodump class; extract SourceImage path, signature, and command line (`sekurlsa::`, `-ma lsass`, `comsvcs ... MiniDump`); exclude false positives by filtering out legitimate EDR/backup processes