Potential Credential Dumping Activity Via LSASS

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•1•0•37

Detects process access requests to the LSASS process with specific call trace calls and access masks. This behavior is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.