ConceptsLSASS Memory Dumping Detection

LSASS Memory Dumping Detection

Detecting attempts to dump the memory of the Windows LSASS process, a strong sign of credential theft, by monitoring for suspicious processes accessing LSASS or known dumping techniques.

Glossary definition

7 direct links5 lessons

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Endpoint Telemetry

The foundation LSASS Memory Dumping Detection builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Endpoint TelemetryStart here

The activity data collected from endpoints, process creation, file and registry changes, network connections, logons, that feeds detection and investigation. It is one of the richest and most important telemetry sources for defenders.

lessons

Relatedsorted by lesson coverage

Detection Specificity

lessons

MITRE ATT&CK

lessons

PowerShell Detection

lessons

LSASS

lessons

Credential Dumping

lesson

Mimikatz

lesson

Related Lessons

5 lessons cover this concept

Use ATT&CK Without Overclaiming Coverage

SOC Analyst

From Hypothesis to Telemetry Contract

SOC Analyst

Build Endpoint Behavior Analytics

SOC Analyst

Correlate Identity, Remote Access, and Network Behavior

SOC Analyst

Engineer Rules, Tuning, and Response Contracts

SOC Analyst