Credential Dumping Detection: How to Catch LSASS Access, Mimikatz, and Hash Theft

Credential dumping is the step that turns a foothold into full domain compromise. Once an attacker has local admin on one machine, their next move is almost always to pull credentials from that machine — LSASS memory, the SAM database, cached domain credentials — and use those to move laterally. Catching this technique early is one of the highest-value detections you can have running.

The challenge is that credential dumping techniques have evolved significantly. LSASS dumping via Task Manager is detectable. But modern tooling uses driver-based access, custom LSASS clones, and memory-only techniques specifically designed to evade standard detections. This post covers what still works reliably for detection across real environments.

1. LSASS Memory Access Detection

LSASS (Local Security Authority Subsystem Service) stores credential material in memory — NTLM hashes, Kerberos tickets, plaintext passwords in some configurations. Mimikatz, ProcDump, Task Manager dumps, and many other tools access LSASS memory to extract these. The detection relies on Sysmon Event ID 10 (Process Access) targeting lsass.exe, or CrowdStrike's native LSASS protection events.

Event
| where TimeGenerated > ago(1d)
| where Source == "Microsoft-Windows-Sysmon"
| where EventID == 10
| extend EventData = parse_xml(EventData)
| extend
    TargetImage = tostring(EventData.DataItem.TargetImage),
    SourceImage = tostring(EventData.DataItem.SourceImage),
    GrantedAccess = tostring(EventData.DataItem.GrantedAccess)
| where TargetImage endswith "lsass.exe"
// 0x1010 and 0x1410 are common dump access masks
| where GrantedAccess in(
    "0x1010", "0x1410", "0x147a",
    "0x143a", "0x1fffff"
  )
// Exclude known-legitimate processes
| where SourceImage !has_any(
    "MsMpEng.exe", "csrss.exe",
    "wininit.exe", "services.exe"
  )
| project TimeGenerated, Computer,
    SourceImage, TargetImage, GrantedAccess
| order by TimeGenerated desc

// CrowdStrike natively blocks many LSASS access attempts
// This catches attempts that reach the process level
#event_simpleName=ProcessRollup2
TargetProcessImageFileName=/lsass\.exe$/i
| groupBy([FileName, UserName, ComputerName],
    function=count(), as=AccessCount)
| where AccessCount > 0
| sort(AccessCount, order=desc)

2. Mimikatz Command Line Detection

Despite being years old, Mimikatz in various forms still appears in the majority of credential theft cases. The command line arguments are distinctive and show up reliably in 4688 process creation events when command line logging is enabled.

index=win_* sourcetype="WinEventLog:Security"
EventCode=4688 earliest=-24h
| eval cmdline=lower(coalesce(
    Process_Command_Line, CommandLine))
| eval risk=case(
    match(cmdline, "sekurlsa|logonpasswords|lsadump"),
        "MIMIKATZ_CONFIRMED",
    match(cmdline, "dcsync|dcshadow|krbtgt"),
        "MIMIKATZ_CONFIRMED",
    match(cmdline, "privilege::debug|token::elevate"),
        "MIMIKATZ_CONFIRMED",
    match(cmdline, "mimikatz|mimilib|mimidrv"),
        "MIMIKATZ_BINARY",
    1==1", "review")
| where risk != "review"
| table _time host user cmdline risk
| sort 0 -_time

3. SAM Database Access

The SAM (Security Account Manager) database stores local account password hashes. Attackers target it via registry hive dumps — reg.exe save commands targeting HKLM\SAM, HKLM\SYSTEM, and HKLM\SECURITY. These three hives together allow offline extraction of all local account credentials.

DeviceProcessEvents
| where TimeGenerated > ago(1d)
| where FileName in~("reg.exe", "regedit.exe")
| where ProcessCommandLine has_any(
    "save", "export")
| where ProcessCommandLine has_any(
    "hklm\\sam", "hklm\\security",
    "hklm\\system", "\\sam"
  )
| project TimeGenerated, DeviceName,
    AccountName, FileName, ProcessCommandLine
| order by TimeGenerated desc

4. NTDS.dit Extraction

NTDS.dit is the Active Directory database stored on every domain controller — it contains the password hashes for every domain account. Extracting it gives an attacker offline access to every credential in the domain. It's protected while AD is running, so attackers use Volume Shadow Copy, ntdsutil, or vssadmin to extract it.

index=win_* sourcetype="WinEventLog:Security"
EventCode=4688 earliest=-24h
| eval cmdline=lower(coalesce(
    Process_Command_Line, CommandLine))
| where match(cmdline,
    "ntds\.dit|ntdsutil|vssadmin.*ntds|
    diskshadow.*ntds|ifm.*ntds")
| table _time host user cmdline
| sort 0 -_time

5. Credential Theft via Task Manager and ProcDump

The least sophisticated but still commonly seen approach is using Task Manager or SysInternals ProcDump to create a memory dump of the LSASS process. Both are legitimate tools that get flagged for this specific usage pattern.

#event_simpleName=ProcessRollup2
FileName=/procdump(64)?\.exe$/i
| regex("(?i)lsass", field=CommandLine)
| table @timestamp ComputerName UserName
    FileName CommandLine
| sort(@timestamp, order=desc)

// Task Manager dump — look for lsass.DMP creation
// in %TEMP% or %LOCALAPPDATA%\Temp

DeviceFileEvents
| where TimeGenerated > ago(1d)
| where ActionType == "FileCreated"
| where FileName has_any(
    "lsass.dmp", "lsass.zip",
    "lsass.rar", "lsass.7z")
// Dump file in any location is suspicious
| project TimeGenerated, DeviceName,
    AccountName, FileName, FolderPath,
    InitiatingProcessFileName
| order by TimeGenerated desc

What to Do When These Fire

Credential dumping alerts have a different response protocol than most alerts because the damage compounds rapidly. The moment credentials are dumped, an attacker can use them immediately from any system on or off the network. Standard investigation-before-containment doesn't apply here.

• Isolate the host immediately via EDR network isolation — before investigating, before calling anyone, before opening a ticket
• Revoke all credentials for accounts that were logged into the affected host — reset passwords, revoke Kerberos tickets, disable sessions in Entra ID
• Check for lateral movement in the 30 minutes before and after the credential dump event — where did those credentials go next
• Pull process tree from EDR to understand what ran before the dump tool — that's your initial access vector
• Escalate to P1 immediately and don't close or downgrade until you've confirmed the scope of compromised credentials