Built a lightweight, zero-dependency LSASS dump detector and handle…

Hi all,

OS credential dumping targeting LSASS (T1003.001) remains one of the primary post-exploitation techniques in Windows environments. While modern enterprise EDRs have robust kernel callbacks, I wanted to build a transparent, standalone Python utility to inspect how handle table analysis and memory access masks can detect dumper behavior at the endpoint level.

The tool is called **MemGuard** (MIT licensed, zero dependencies):

GitHub: https://github.com/prox0959/MemGuard

### 🛠️ Key Mechanics:

**Handle Audit:** Queries `NtQuerySystemInformation(SystemExtendedHandleInformation)` to map which processes hold active handles to `lsass.exe`.
**Access Mask Filtering:** Specifically flags unauthorized processes granted `PROCESS_VM_READ` (`0x0010`) while whitelisting core system services (`csrss.exe`, `services.exe`, Windows Defender).
**PEB Inspection:** Direct memory read of `PEB->ProcessParameters->CommandLine` via `NtQueryInformationProcess` to detect LOLBin dump attempts (e.g. `comsvcs.dll MiniDump` or ProcDump flags).
**Active Triage:** Supports freezing suspect processes via `NtSuspendProcess` rather than immediate termination, maintaining volatile RAM for artifact recovery.

Would love to hear thoughts from detection engineers and blue teamers on edge cases or bypasses you'd anticipate (e.g. handle stripping, direct kernel object manipulation).

Feedback and GitHub stars are always welcome!

Impact

Credential dumping from LSASS memory can expose sensitive user credentials, including Kerberos tickets and NTLM hashes, potentially allowing attackers to escalate privileges and move laterally within a Windows domain environment. MemGuard helps detect and mitigate these attacks by identifying unauthorized handle access and suspicious process behavior, reducing the risk of credential theft. However, it is a detection and mitigation tool rather than a vulnerability or exploit itself.

Defensive guidance

MemGuard provides active detection and mitigation capabilities for LSASS memory dumping attempts. It can be run in monitoring mode to alert on suspicious activity or in active mode to suspend offending processes, preserving forensic evidence. Users should deploy MemGuard as part of their endpoint security strategy to complement existing protections.

Summary

MemGuard implements a zero-dependency Windows endpoint detection utility in pure Python that monitors for unauthorized access to lsass.exe memory, a common target for credential dumping attacks. It enumerates system handles via NtQuerySystemInformation(SystemExtendedHandleInformation) to find processes holding handles to lsass.exe with critical access rights such as PROCESS_VM_READ or PROCESS_ALL_ACCESS. It whitelists known system processes and flags unverified ones. Additionally, it reads the Process Environment Block (PEB) to inspect command lines for LOLBin-based dumping attempts (e.g., comsvcs.dll MiniDump, procdump). When configured, it can suspend suspicious processes using NtSuspendProcess to prevent memory dumps while preserving volatile memory for forensic analysis. The tool is intended as a free, transparent alternative to commercial EDRs for detecting credential dumping techniques.

Built a lightweight, zero-dependency LSASS dump detector and handle table auditor in pure Python (Win32/NT ctypes)

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 24 Sep 2026, 19:47 UTC

Technical details

References

Community reviews