What is credential dumping?

Last updated: 2026-08-21Endpoint Security

Credential dumping is the theft of stored authentication material from an operating system: passwords, hashes and tickets extracted from memory structures such as LSASS, from the SAM database, or from DPAPI stores. It is the pivotal move in most intrusions — dumped credentials turn one compromised endpoint into domain-wide access. 1stProtect’s published risk model scores it 88 of 100 and calls it "keys to the kingdom."

Also known as: LSASS dumping · credential theft attack · password dumping · mimikatz attack

How attackers dump credentials

The classic move is reading LSASS process memory — with tools like Mimikatz, with legitimate utilities, or with a crafted memory dump — yielding the hashes and tickets of every user who logged into the machine. Alternatives include copying the SAM database, harvesting DPAPI-protected secrets, and pulling saved credentials from browsers. Whatever the path, the output is the same: reusable authentication material for lateral movement and privilege escalation.

Blocking it at the operating system

Detection-based tools recognize known dumping tools and patterns — and attackers respond with renamed binaries, living-off-the-land techniques and novel access methods. OS-level prevention takes the durable position: the sensitive stores themselves are guarded, so a process reading LSASS or the SAM without legitimate cause is blocked in the act, whatever tool attempts it. That is the design behind 1stProtect’s CredentialProtect engine — enforcement at the asset, not recognition of the attacker.

// In the Cyberdis portfolio

1stProtect guards the credential stores themselves — distributed by Cyberdis.

Explore 1stProtect Request a PoC

// FAQ

Common questions.

What is LSASS and why do attackers target it?

LSASS (Local Security Authority Subsystem Service) is the Windows process that handles authentication, and its memory holds credentials of logged-in users. Read it, and you hold everyone who touched that machine — which is why LSASS access is the most watched event in endpoint security.

Does EDR stop Mimikatz?

Known Mimikatz builds, usually. Renamed, rebuilt or memory-only variants and native-tool equivalents routinely evade recognition. Prevention that guards the credential stores themselves does not care what the tool is called.

How does real-time prevention handle credential dumping differently?

It blocks the access at the moment it is attempted — an unauthorized read of LSASS or the SAM fails, whoever attempts it — rather than detecting a tool and responding after the material is already stolen.

Weighing approaches? Real-time endpoint prevention vs EDR: stop the attack, or investigate it?