LsaIso.exe
Summary
LSA Isolated (Credential Guard). Runs in a Hyper-V isolated Virtual Secure Mode (VSM) to protect credential material (NTLM hashes, Kerberos tickets) from being extracted by attackers, even with SYSTEM access.
LsaIso.exe is the 2287th most commonly executed Windows program in EchoTrail's dataset, observed 216 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by wininit.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 5c8006cad3834528025f6d9ce308ea68e6d759a4166b4a3e6de03297490e3eed15.28%
- 89b23f83b0f5b08ca286de2a6e650729a8652230938447d9a0d3f3d815d41bb410.65%
- 74d594864655f53d659edff569844c8da622da8e6b4391906f14c73d7496c7fc9.72%
- 2a1b79bdafdce022d4c21ef372768a94ce03d80e2a5bdd4119ab946230ffdf6f8.33%
- 713f349e67b8af9de1aa157e1b7fa69b8b899fead9a518630bae7defb164eb677.41%
- 0b2b77b28fd6931b3b49435e3736433df7941a579debfd130473129d7af3a3ab6.94%
- c16a46ab3f282f34f829d4fa8905594e469a09a2dddadb525e67d121a6310ee86.48%
- d9252660b149c2ddc98004e2e0b5c56117ecce67b12a27452770f89f5039942d5.56%
- 4224814b61f12b7e4fca30010d83b668021d81db6d2b9e45c32d591bc32199875.09%
- 227085d91adf5478d72442f2c7adf1438e3fcca60ebccf46ce57d1cf5254bf444.63%
Process Ancestry
Top Parents
- wininit.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does LsaIso.exe normally do?
Runs from C:\Windows\System32. Present only on systems with Credential Guard enabled (requires Hyper-V, UEFI Secure Boot). Runs in an isolated process within Virtual Secure Mode. Should always be running when Credential Guard is active. Single instance.
When is LsaIso.exe suspicious?
lsaiso.exe not running on a system where Credential Guard is expected. Multiple instances. Running from a non-System32 path. Any process attempting to access or read lsaiso.exe memory.
How do attackers abuse LsaIso.exe?
lsaiso.exe is a defensive control, not an attack tool. Its presence indicates Credential Guard is active, which prevents most credential dumping techniques (Mimikatz, LSASS memory access). Attackers may attempt to disable Credential Guard via: - bcdedit modifications to disable hypervisor - Disabling VBS (Virtualization-Based Security) via Group Policy - Exploiting hypervisor vulnerabilities to escape VSM Absence of lsaiso.exe on systems that should have Credential Guard is itself an indicator of tampering.
Detection guidance
MONITOR FOR: - Credential Guard being disabled (bcdedit changes to hypervisorlaunchtype, VBS policy changes) - lsaiso.exe stopping unexpectedly on Credential Guard-enabled systems - Processes attempting to read lsaiso.exe memory DATA SOURCES: Process creation/termination (Sysmon 1/5), registry events for VBS policy
False positive notes
Not present on systems without Credential Guard (Windows 10/11 Enterprise with Hyper-V). VMs may not support Credential Guard depending on hypervisor configuration.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about LsaIso.exe
Rocky answers questions about LsaIso.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.