Hackers Abusing LSASS Process Memory to Exfiltrate Login Credentials

Threat actors have been using several methods for credential stealing, which varies based on the environment and infrastructure of the system.

Most of the time, the threat actors dump the LSASS process to extract the account credentials.

For this, tools such as Mimikatz, which offers several suspicious features, can be used. However, most security products are focused on these kinds of malicious tools that the threat actors know.

Many new methods to dump LSASS memory that maliciously use legitimate …

abusing account can credential credentials credential stealing environment extract features hackers infrastructure login login credentials lsass memory mimikatz process stealing system threat threat actors tools