Back to queue

Credential dumping: C:\WINDOWS\system32\svchost.exe accessed LSASS memory

#100010WORKSTATION-01Oct 09, 2026, 08:50:26 PMSAMPLE DATA
How to read this

An alert is one thing a detection rule flagged. The severity comes from the rule's level.

The process tree shows what launched what. A normal tool launched by an unexpected parent is often the first sign of trouble.

ATT&CK maps the behaviour to a known attacker technique. The raw event on the right is the original log, with real hostnames, users and IPs replaced by placeholders.

AI triage assist

Generate a plain-English assessment: likely verdict, reasoning, ATT&CK mapping, and the next checks an L1 analyst should make. You decide what to do with it.

Fresh analysis runs in analyst mode. The public demo shows cached results only.

Key fields

Host
WORKSTATION-01
User
user01
Target
lsass.exe
Event ID
10
Channel
Microsoft-Windows-Sysmon/Operational
Granted access
0x1410
Rule
#100010 (level 12)

Process tree

  1. svchost.exeprocess
    C:\WINDOWS\system32\svchost.exe
  2. lsass.exetarget
    C:\WINDOWS\system32\lsass.exe

ATT&CK mapping

T1003.001LSASS MemoryCredential Access

Analyst notes

Raw event
_id:"abc123"
}
id:100010
level:12
description:"Credential dumping: C:\WINDOWS\system32\svchost.exe accessed LSASS memory"
}
id:"001"
ip:"192.0.2.1"
name:"WORKSTATION-01"
}
timestamp:"2026-10-09T22:50:26.563+02:00"
}