Unsigned/Low-Reputation Process LSASS Memory Access - T1003.001

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

Detects instances where an unsigned or non-trusted process attempts to access the memory of the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by threat actors to harvest credentials for lateral movement and privilege escalation.