Dumping credentials from LSASS (Mimikatz)

lsass.exe (Local Security Authority Subsystem Service) is the Windows process responsible for authentication: it validates logins, manages tokens and, to provide Single Sign-On, keeps authentication material for active sessions in memory: NTLM hashes, Kerberos tickets and, depending on configuration, even cleartext passwords (via the WDigest provider on old or misconfigured systems).

Mimikatz is the go-to tool to read that memory. With sufficient privileges (SeDebugPrivilege, which a SYSTEM process or an administrator has), it opens the lsass process and extracts the credentials:

privilege::debug              :: enable SeDebugPrivilege
sekurlsa::logonPasswords      :: dump credentials from active sessions

What you get.

• NTLM hashes of logged-on users, reusable with Pass-the-Hash.
• Kerberos tickets (TGT/TGS), reusable with Pass-the-Ticket.
• Cleartext passwords, if WDigest is enabled or they linger in memory from other providers. On Blue, Administrator's password shows up directly.

Why it matters. It turns local admin access into a credential haul that enables lateral movement: with the hash or ticket of a user who has a session on that machine, the attacker jumps to other systems where that user has access, without ever touching their password.

Alternatives to the binary. You don't always upload mimikatz.exe (AV flags it). It's common to dump the lsass memory and process it offline on the attacker box with mimikatz or pypykatz.

# dump lsass to disk (pick one route)
procdump.exe -accepteula -ma lsass.exe lsass.dmp
tasklist /fi "imagename eq lsass.exe"                       # get the PID
rundll32 C:\Windows\System32\comsvcs.dll, MiniDump <pid> C:\lsass.dmp full

# process the dump offline, on the attacker
pypykatz lsa minidump lsass.dmp
# or in mimikatz: sekurlsa::minidump lsass.dmp  ->  sekurlsa::logonPasswords
# over the network, with admin credentials
netexec smb <ip> -u <user> -p <pass> -M lsassy

How to detect it. The most reliable trace is a process opening lsass.exe: with Sysmon, Event ID 10 (ProcessAccess) against lsass.exe with GrantedAccess masks typical of dumping (0x1010, 0x1410, 0x143a) from a process that is not a security product. Without Sysmon, enabling Audit Handle Manipulation surfaces 4656/4663 (object access) on lsass. Dumping to disk also leaves a Sysmon 11 (FileCreate) of a .dmp, and the comsvcs.dll MiniDump route a 4688 with command line rundll32 comsvcs.dll, MiniDump. pypykatz/scripts on the host show up via 4104 (PowerShell script block). The key is that almost nothing legitimate opens lsass with memory-read rights.

Defence. Credential Guard (isolates LSA secrets in a virtualized environment), RunAsPPL (protects lsass as a Protected Process Light), disabling WDigest, and reducing the number of privileged interactive sessions: the fewer powerful credentials in memory, the smaller the loot. Related to Pass-the-Hash and credential reuse.