LSASS Memory Dump via Direct Process Access (T1003.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (lsass.exe). This activity often indicates attempts to dump process memory to harvest sensitive credentials, a common technique used by attackers to facilitate lateral movement.