Enter your search text in the box above

Select a result to preview

Module 10 — LSASS, Identity, and Authentication

#windows #windows-11 #lsass #authentication #module

Module 10 — LSASS, Identity, and Authentication

Summary

lsass.exe is the authentication broker for Windows. Security engineers must understand what loads inside it, how Credential Guard changes the threat model, and which Security log Event IDs prove logon abuse.

Path: Evidence & EVTX · Related: LSASS vault note

0. Purpose

Identity attacks target LSASS, tickets, and tokens. Defenders instrument logons (4624/4625/4648/4672), harden LSA, and know when Credential Guard is actually on.

1. ELI5

When you log in, Windows does not check your password inside Notepad. It sends the proof to lsass.exe — the ID desk of the building.

The desk hires specialists ( security packages ) who speak NTLM, Kerberos, and cloud login. Credential Guard is like moving the master key drawer into a vault room the desk cannot open — dumps of the desk become less useful.

2. What runs inside lsass.exe

flowchart TB
  subgraph lsass [lsass.exe — LSA host]
    CORE[LSA core
sessions, policy]
    MSV[MSV1_0 — NTLM]
    KERB[Kerberos package]
    NEGO[NegoExt — negotiation]
    CLOUD[CloudAP — Azure AD path]
  end

  WINLOGON[winlogon.exe] --> lsass
  APPS[Services / processes] -->|auth requests| lsass
  lsass --> DC[Domain Controller / KDC]
Component Type Role
LSA core Built-in Session table, package loader, policy
MSV1_0 SSP NTLM challenges, local/domain validation
Kerberos SSP Tickets, PAC, KDC comms
NegoExt SSP Picks NTLM vs Kerberos
CloudAP SSP Modern AAD / WAM sign-in (Win11)
Authentication Packages AP Interactive logon UI collection

Registry anchors:

Key Content
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages SSP DLL list
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages AP DLL list
SSP persistence

Malicious Security Package registration = code inside LSASS. Monitor registry + Sysmon ImageLoad into lsass.exe (when Sysmon deployed).

3. Credential Guard (lab .114 posture)

From baseline audit:

Field Value
SecurityServicesRunning {0} — Credential Guard not running
VirtualizationBasedSecurityStatus 0
CodeIntegrityPolicyEnforcementStatus 2

When CG is enabled (Enterprise + hardware):

Secret Without CG With CG
NTLM hashes in LSASS Present in memory Isolated in LSAISO
Kerberos long-term keys In LSASS Isolated
LSASS dump value High for cred theft Reduced for hash extraction

CG does not stop: pass-the-ticket, token theft from other processes, interactive phishing logons.

Verify anytime:

Get-CimInstance Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object SecurityServicesRunning, VirtualizationBasedSecurityStatus

4. Event IDs that matter (Security log)

ID Name Defensive use
4624 Successful logon Baseline LogonType, source IP, package name
4625 Failed logon Spray, brute force — watch SubStatus
4648 Logon with explicit credentials RunAs, net use, scheduled creds — lateral movement
4672 Special privileges assigned New high-priv session (SeDebug, etc.)

LogonType cheat sheet (4624)

Type Name Example
2 Interactive Console / local keyboard
3 Network SMB, admin share
10 RemoteInteractive RDP
5 Service Service account start

Correlation patterns

Pattern Events Interpretation
Password spray Many 4625 → one 4624 Spray succeeded
Lateral explicit creds 4648 then 4624 Type 3 RunAs / net use pivot
Privileged session 4672 + 4624 Type 10 RDP/console admin

5. LSASS on the network (lab .114)

lsass.exe holds RPC listeners in the 49664 ephemeral range (see baseline listening ports). Do not expose lab SMB/RPC to untrusted networks.

Port Service
445 SMB
135 RPC endpoint mapper
49664+ LSASS / RPC

6. Hardening checklist

7. Lab exercises — .114

# LSASS process baseline
Get-Process lsass | Select-Object Id, Path, @{N='MB';E={[math]::Round($_.WorkingSet64/1MB,1)}}

# Security packages (read-only)
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' |
  Select-Object 'Security Packages', 'Authentication Packages'

# Recent auth events
Get-WinEvent -LogName Security -MaxEvents 50 |
  Where-Object { $_.Id -in 4624,4625,4648,4672 } |
  Select-Object TimeCreated, Id, @{N='Msg';E={$_.Message.Substring(0,200)}} | Format-List

← Module 9 · MOC