Lion Cipher Lab
Detect credential dumping: LSASS access, the API calls, and the memory artifacts
- Digital Forensics & IR (DFIR)
- Advanced
- ~50 min
- Free · no account required
Why it matters
Once an attacker has a foothold on one Windows box, the very next move that turns a single compromised machine into a compromised network is credential theft: reach into the part of Windows that holds passwords, hashes and Kerberos tickets, and steal the keys to every other system. The richest target is LSASS — the Local Security Authority Subsystem Service, the process that validates logons and caches secrets in its memory — and the second is the SAM, the registry database of local account password hashes. A defender who can read the handful of artifacts these thefts leave behind can catch…
What you'll learn
- reading a Sysmon Event ID 10 (ProcessAccess) record and recognising an lsass.exe open as the top credential-theft signal
- decoding a GrantedAccess mask and spotting PROCESS_VM_READ (0x0010) — the right that means 'read another process's memory'
- reading a ProcessAccess CallTrace and recognising the MiniDumpWriteDump dump DLLs (dbghelp.dll / dbgcore.dll) as evidence of an LSASS memory dump
- recognising an lsass.dmp dump-file artifact and a `reg save HKLM\SAM/SECURITY/SYSTEM` hive theft
- telling LSASS memory dumping (.001) from SAM hive extraction (.002) from DCSync (network) at a concept level
- mapping observed behaviour to MITRE ATT&CK T1003 OS Credential Dumping and its sub-techniques
- judgment: tuning out legitimate LSASS accessors, when you need memory forensics, and responding by force-resetting exposed credentials and deploying Credential Guard / LSA PPL
Steps in this lab
- The behaviour we're detecting, in plain English
- The one Sysmon event that catches an LSASS read: Event ID 10
- The scenario: an LSASS-access alert lands on your queue
- Read the ProcessAccess record: target, mask, and the read bit
- The memory artifact on disk: the lsass.dmp FileCreate
- The second theft: SAM/SECURITY/SYSTEM hive extraction
- Concept map: LSASS dumping vs SAM extraction vs DCSync — and the MITRE tree
- The pro's judgment: tune out the legit accessors, know when you need memory forensics, and respond