lsass.exe

by Microsoft

Operating Systemcritical risk

Summary

Local Security Authority Subsystem Service (LSASS) enforces security policy, handles user authentication, generates access tokens, and manages password changes. It is one of the most critical Windows processes and a primary target for credential theft attacks.

lsass.exe is the 502nd most commonly executed Windows program in EchoTrail's dataset, observed 11,412 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by wininit.exe.

502nd

most commonly executed Windows program

11,412

observed executions

medium

statistical confidence

Behavior

Top Paths

C:\Windows\System3299.96%
C:\...0.04%

Top Hashes (SHA256)

adadfa0d533944579ba0e5fe31a68d4d1395e7b9db75e58d47e0adc0da5ad16c27.92%
5c9bb19d447698f4eae8d9a26548703c4b8b6feb68d49e6f2516666e5226236a9.58%
aa52b2d3dd4b9b47ff4496c0460bdedda791354018cf0782b899ef28acee8d218.86%
9c7229f10f11d18e1fed6395391a46225a84b421034b9ab6f81af7430fdc556f7.16%
bbc83e4759d4b82bad31e371ad679aa414c72273bf97cee5aed8337ed8a4d79f4.51%
f56dddf7a8f1aa0f3d9ffe0cd618544cfaf233a33314240eccbe5f897a91b5343.91%
593da57cdd02f4cc3a5125ce5707c222dd922f2936d16492ba21ac6c345ec6b02.98%
d28f6bbcba07ad8fc17c99d701a0c9367270c4a504baab7b840931bbf333d65d2.4%
c45d99a69085aec6d27dcd8a188b2b53bf2cf063d1f23b14c68079ddef7be78c2.33%
819375c0e3c6004b0b45575410ec0bdad2b430a7752814711156ed9d60f7bae82.03%

Process Ancestry

Top Grandparents

smss.exe93.17%
svchost.exe3.86%
fontdrvhost.exe1.45%
WUDFHost.exe0.48%
winlogon.exe0.41%
LogonUI.exe0.29%
dwm.exe0.08%
cmd.exe0.06%
AcronisFilesAdvancedClientService.exe0.01%
epsecurityservice.exe0.01%

Top Parents

wininit.exe99.96%
python.exe0.04%

Top Children

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Security Analysis

What does lsass.exe normally do?

Located in C:\Windows\System32. Always launched by wininit.exe. Exactly one instance. Runs as SYSTEM. Starts within seconds of boot. Handles NTLM, Kerberos, and other authentication packages.

When is lsass.exe suspicious?

Any process accessing lsass.exe memory (OpenProcess with PROCESS_VM_READ). Running from any path other than System32. Parent other than wininit.exe. More than one instance. Running under any account other than SYSTEM. Name misspellings (1sass.exe, lsas.exe, lsass32.exe). Processes creating minidumps of lsass (credential dumping).

How do attackers abuse lsass.exe?

Credential dumping: the most common attack against lsass. Tools like Mimikatz, WCE, ProcDump, comsvcs.dll MiniDump, and custom tools extract cleartext passwords, NTLM hashes, and Kerberos tickets from lsass memory. This is often the pivotal step in lateral movement. LSASS dump methods: (1) Mimikatz sekurlsa::logonpasswords, (2) ProcDump -ma lsass.exe, (3) comsvcs.dll MiniDump via rundll32, (4) Task Manager create dump file, (5) WerFault silent process exit abuse, (6) direct NTAPI calls. Name/path masquerading: malware uses lsass.exe name from wrong paths. Process injection: injecting into lsass for credential interception.

Detection guidance

High-confidence: Any process calling OpenProcess on lsass.exe with memory read permissions (Sysmon Event ID 10 with TargetImage=lsass.exe). lsass.exe running from non-System32 path. More than one lsass.exe instance. Minidump files (.dmp) being created for lsass. Medium-confidence: rundll32.exe loading comsvcs.dll with MiniDump in the command-line. ProcDump targeting lsass. Enable Credential Guard (Windows 10+) to protect LSASS with virtualization-based security. Enable RunAsPPL (Protected Process Light) for lsass.

False positive notes

Some legitimate security tools (AV, EDR) access lsass memory for monitoring. Windows Defender (MsMpEng.exe) scans lsass. Credential Guard and PPL mode generate events that look like access attempts. WerFault may legitimately dump lsass after a crash (rare).

MITRE ATT&CK techniques

T1003.001 T1003.002 T1003.003 T1003.004 T1003.005 T1055 T1036.005

Related Processes

svchost.exe wininit.exe winlogon.exe

Ask Rocky about lsass.exe

Rocky answers questions about lsass.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.