Security

LSASS (Local Security Authority Subsystem Service)

The Windows process that enforces logon policy and holds credential material for logged-on users in memory. Attackers dump its memory to recover password hashes and tickets, making LSASS access a key post-exploitation indicator.

Deep dive

Learn Article

How to Hunt VPN Logs for Sessions That Never Entered a Password

An auth bypass leaves one successful login and no failures. Pivot on authentication method, source ASN, client hostname and lease patterns, then follow every hit inward.

intermediate 6 min read

Back to glossary