Suspicious Process Opened Handle to lsass.exe for Memory Access

Ethan Andrews@eandrews

•updated Jun 30, 2026•6•0•3

Detects unauthorized or suspicious processes attempting to open a handle to the Local Security Authority Subsystem Service (lsass.exe) with access rights required for memory reading, such as PROCESS_VM_READ or PROCESS_QUERY_INFORMATION. This behavior is a common prerequisite for credential dumping techniques like Minidump or direct memory extraction used by malicious tools.