Credential Dumping: LSASS, Mimikatz, and Modern Defenses

The problem with credential dumping is not Mimikatz. It is that one compromised host may hold the authority to compromise the rest of the environment.

Blocking a famous executable handles the easiest case. Attackers can read memory through other code, abuse a signed utility, copy an account database, request directory replication, or steal a session token. The defensive job is bigger: reduce the useful credential material on each system, detect access to the stores that remain, and know which identities must be contained when exposure occurs.

This is an identity blast radius problem. If a server holds sessions for five privileged administrators and each identity can reach 40 systems, one memory dump can create up to 200 identity and target edges. The dump file may be one artifact. The response scope is every usable route behind it.

What is credential dumping?

Credential dumping is the collection of passwords, password hashes, tickets, keys, tokens, or other authentication material from an operating system or identity store. Attackers use that material to act as users, services, devices, or administrators. They may crack it offline, replay it directly, or use it to create new access.

MITRE ATT&CK tracks OS Credential Dumping as T1003 and divides it by store. Its Windows LSASS Memory page, subtechnique T1003.001, was updated May 12, 2026. The procedure examples include Mimikatz, signed utilities, process dumps, injection, and custom tools. That range is why a filename rule cannot carry the program.

Credential access often feeds a lateral movement path. A stolen NT hash may support pass the hash. A Kerberos ticket may support pass the ticket. A directory database can expose many identities at once. A cloud token can bypass the password flow entirely.

Which credential stores do attackers target?

On Windows, LSASS manages authentication and single sign on material for active sessions. The Security Account Manager holds local account hashes. LSA secrets can contain service and machine account material. Cached domain credentials support sign in when a domain controller is unavailable. The Active Directory database holds domain credential data, while directory replication rights can expose equivalent material without copying the database file.

The difference changes response. An LSASS dump on a workstation may expose users who recently signed in there. A SAM copy concerns local accounts on that machine, but reused local passwords can widen the route. Directory replication or database access can turn the incident into domain recovery. Do not put every alert into one generic "credential theft" playbook.

Linux and macOS have different stores, but the same model applies. Password hash files, keychains, SSH keys, browser stores, process environment values, agent sockets, and cloud command line credentials can all provide usable authority. Inventory secrets by where they exist, which process can read them, how long they remain valid, and where they work.

Why is blocking Mimikatz not enough?

Mimikatz made Windows credential extraction visible to a broad audience. It is still used. But defenders lose when they turn a technique into a product name. The same LSASS memory can be targeted by custom code, a renamed tool, process injection, a memory snapshot, or an allowed diagnostic utility.

Detect behavior around the protected process and the resulting artifact. Look for unusual process access to LSASS, memory dump creation, access from a process that does not normally inspect authentication services, suspicious reads of credential related registry hives, and archive or transfer activity soon after the access. Keep process ancestry, signer, user, integrity level, target process, access rights, and file creation in the same case.

A signed binary is context, not innocence. Administrators and support tools sometimes create dumps for diagnosis. The owner, change window, target process, destination path, and follow on network activity decide whether that use makes sense.

What does current breach data say about credential theft?

The 2026 Verizon Data Breach Investigations Report counted 14,309 System Intrusion incidents, including 13,758 with confirmed data disclosure. Within System Intrusion breaches, credentials were among the data compromised in 26 percent of cases. The report also calls out password dumpers and lateral movement techniques in that pattern. See the Verizon 2026 DBIR, published May 18, 2026.

These figures do not mean every dumped credential caused a breach. They show why the material matters once system intrusion is underway. A password dumper is rarely the end goal. It converts host access into identity access, then identity access into reach.

Which controls prevent useful credential dumps?

Reduce what exists before trying to protect it. Remove stored passwords from scripts and scheduled jobs. Replace shared service accounts with managed identities where supported. Use unique managed local administrator passwords. Shorten token life where the operational cost is acceptable. Stop privileged users from signing in to lower trust systems.

Protect the stores that remain. On supported Windows devices, use LSA protection and Credential Guard. The latter isolates supported domain secrets with virtualization based security. Remote Credential Guard can keep credential derivatives from being sent to an RDP target. These controls reduce common extraction paths, but they do not protect every token, browser secret, local hash, certificate, or cloud credential.

Limit where stolen material works. Restrict NTLM, narrow remote administration by source and target, remove shared passwords, require approved management devices, and reduce standing privilege. Our guide to preventing lateral movement shows how segmentation, tiering, and credential hygiene cut the route after exposure.

How can operators verify Credential Guard coverage?

Policy assignment is not proof that the protection is running. Microsoft documents a PowerShell check against the Win32_DeviceGuard class in its Credential Guard configuration guide. Run this from an elevated PowerShell session on systems you manage:

Microsoft documents 0 as disabled and 1 as running for this check. Test a representative sample after rollout, then query fleet coverage through your approved endpoint management system. Record devices that lack the required hardware, firmware, operating system, or policy state. An unknown result is not protected coverage.

Also verify that privileged users do not sign in to machines outside the protected set. Eighty percent control coverage may sound good. If the remaining 20 percent includes every help desk jump point and legacy server where administrators work, the exposure is concentrated exactly where it hurts.

How should teams detect credential dumping behavior?

Build detections in layers. The first layer watches access to credential processes and stores. The second watches dump file creation, registry export, directory replication behavior, and suspicious process chains. The third watches what exposed identities do next, especially new remote logons, service creation, task creation, and access to sensitive systems.

Score the sequence. An unusual process opening LSASS is stronger when it writes a large dump and contacts a new address. Directory replication is stronger when the requesting account and source have never performed it. A credential access alert becomes urgent when a privileged identity active on the same host starts reaching new targets.

Do not discard blocked attempts. A prevention control may stop the read, yet the process execution still proves an attacker reached a sensitive point in the chain. The guide to detecting lateral movement explains how to join the source, identity, channel, target, and next action into a usable response case.

What did a 2026 domain compromise reveal?

Microsoft published a detailed Active Directory compromise on April 17, 2026. The actor used Mimikatz against MSV, LSASS, and SAM material, created a remote scheduled task on a domain controller within 24 hours, later sprayed passwords, and reached at least 14 servers through reuse. The actor also attempted remote credential dumping and directory credential access. Read the Microsoft domain compromise case.

The recent defensive development was predictive shielding. Microsoft says Defender can restrict accounts likely exposed on a compromised device before they are observed in later malicious activity. That is a useful correction to host only response. Once dumping is credible, the likely exposed identities are part of the incident even if their next logon has not happened yet.

How should incident response scope credential exposure?

Contain the affected host, but do not stop there. Build a list of users, services, and privileged sessions active during the exposure window. Include cached and machine credentials where the technique supports it. For each identity, list accessible systems, recent logons, active sessions, issued tokens, and authentication material that needs revocation or rotation.

Sequence recovery carefully. Resetting an account from a compromised device gives the new secret back to the attacker. Use known clean administrative systems, revoke sessions, rotate service and machine material, remove persistence, and rebuild hosts that cannot be trusted. Domain database exposure may require a domain recovery plan, not a password change campaign.

Hunt backward and forward. Backward, find the privilege escalation or remote access that enabled the dump. Forward, search every target reached by the exposed identities and every system where the dump file or related process appeared. The Windows privilege escalation guide covers the local routes that often precede LSASS access.

How should teams operate the defense each month?

Review protection coverage on privileged workstations, servers with frequent administrator sessions, identity infrastructure, backup systems, and management platforms. Compare policy state with observed endpoint state. Investigate drift. Check whether service identities still need every target and whether administrators are using the right devices.

Run an approved simulation that produces a safe access signal without collecting usable secrets. Confirm the endpoint event, central alert, identity exposure list, containment action, and case owner. Five tools times two hours of manual evidence stitching is ten skilled hours for one test. Automate the collection, but keep the conclusion reviewable.

Artemes approaches that review with deep endpoint context and AI driven analysis. The useful output is not a confident label. It is a bounded case showing what was observed, which identities may be exposed, what remains unknown, and which verification or containment step an operator should approve next.

Frequently asked questions

Is credential dumping the same as password cracking?

No. Dumping collects authentication material from a system or store. Cracking guesses a password from captured material. Some hashes and tokens can be replayed without cracking.

Does Credential Guard stop Mimikatz?

It protects supported domain secrets by isolating them from the normal operating system. It does not protect every local hash, token, browser secret, certificate, or cloud credential. Verify the exact store and technique.

Should every LSASS access alert trigger a rebuild?

Not automatically. Confirm the process, signer, access behavior, dump artifact, owner, and change context. Credible unauthorized access should trigger identity scoping even before every detail is known.

Why do attackers dump credentials after gaining administrator access?

Local control may reach only one host. Stolen identities can reach other systems, cloud services, backups, or the directory. Credential dumping converts a local foothold into reusable authority.

The executive takeaway

Inventory which privileged identities and secrets exist on your 20 most important Windows systems. Verify Credential Guard and LSA protection from endpoint state, not policy assignment. Alert on access behavior, not tool names. When a dump is credible, contain the host and every identity exposed there, then prove revoked material no longer works from a clean system.