Definition: LSASS.exe stands for Local Security Authority Subsystem Service. It is a critical process in Microsoft Windows. It enforces the security policy on the system. The process handles many security tasks, such as authentication, logon and checking user rights.
Why is LSASS.exe a popular target for attackers?
Attackers often go after LSASS.exe because the process keeps valuable data in memory. This includes credentials and security identifiers. If attackers manage to pull out this data, they can reach secret data. They may even take full control of a system or a whole domain.
How does hacking LSASS.exe work?
Attacks on LSASS.exe can take several forms:
- Memory dumps: Attackers try to read the memory of LSASS.exe to get credentials. These can be password hashes, Kerberos tickets or, depending on the setup, cleartext passwords.
- Exploiting flaws: Unpatched security flaws can give attackers access to the LSASS.exe process.
- Malware: Some malware is built to target LSASS.exe and steal sensitive data.
Typical dangers of attacks on LSASS.exe
- Theft of credentials
- Privilege escalation
- Lateral movement through a network with stolen credentials
Protective measures against attacks on LSASS.exe
- Regular security updates: Keep your operating system and all apps up to date. This closes known flaws.
- Antivirus or EDR tools: Use security software that can spot and block access to LSASS memory.
- Network segmentation: Split your network into smaller, well-secured zones. This limits how far an intruder can move.
- Credential Guard: Microsoft offers this security feature. It isolates credentials and limits access to LSASS.exe.
FAQs on LSASS.exe hacking
How can I tell whether LSASS.exe has been compromised?
Watch for these signs:
- other processes access LSASS memory when they should not
- someone creates memory dumps of the process
- your security software raises matching alerts
Odd logon activity in the network can also point to stolen credentials.
Can I simply disable LSASS.exe?
No. If you turn off this process, your system can become unstable or stop working at all. The right approach is to protect it, not to turn it off.
Best practices for protecting LSASS.exe
Good protection against credential dumping combines several steps:
- Turn on Credential Guard and LSA protection (LSASS then runs as a protected process)
- Keep local admin rights to a minimum, since reading LSASS memory usually needs elevated rights
- Use privileged accounts only on dedicated, hardened systems
- Turn off old sign-in methods that keep cleartext passwords in memory (e.g. WDigest)
- Log access to the LSASS process and have EDR tools monitor it
Common challenges and solutions
- Compatibility: Older third-party drivers or plug-ins can clash with LSA protection or Credential Guard. Test the change on a few systems first.
- Legitimate tools: Attackers often use normal admin and diagnostic tools to create memory dumps. So detection rules should focus on behavior, not only on known malware.
- Admin habits: Logging on to any system with a privileged account raises the risk. Clear rules and training for admins help.
Your next step
Have your Windows systems checked to see how well they resist credential theft. Our experts help you with a security assessment and with the right hardening steps.
Related terms: credential theft, operating system vulnerabilities