StrikeShark LSASS Credential Dump via Suspicious Process Access Mask

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects high-privilege access to the LSASS process (lsass.exe), commonly associated with credential dumping techniques such as LSASS memory reading. The rule monitors for specific process access masks (0x1010 and 0x1fffff) originating from non-system, non-security tool processes.