T1003.001Credential Access
LSASS Memory
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate…
CVEs4
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.4
Reports0
Detections
79 Sigma rules tagged T1003.001LSASS MemoryT1003.00179 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- APT31 Judgement Panda Activitycriticaltest
- HackTool - Credential Dumping Tools Named Pipe Createdcriticaltest
- HackTool - Dumpert Process Dumper Default Filecriticaltest
- HackTool - Dumpert Process Dumper Executioncriticaltest
- HackTool - Inveigh Executioncriticaltest
- HackTool - SafetyKatz Executioncriticaltest
- HackTool - Windows Credential Editor (WCE) Executioncriticaltest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to LSASS Memory
4 CVEs, by priority. Each link shows its badge.- CVE-2024-4577PHP-CGI OS Command Injection VulnerabilityPHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+10 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%79.9priority
- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 moreMITRE CTID mapping of the KEV entry · follow-on activity97.3%Top 0.1%69.0priority
- CVE-2025-32706Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact2.3%Top 16%65.2priority
- CVE-2025-32701Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact1.4%Top 27%58.0priority