MemGuard implements a zero-dependency Windows endpoint detection utility in pure Python that monitors for unauthorized access to lsass.exe memory, a common target for credential dumping attacks. It enumerates system handles via NtQuerySystemInformation(SystemExtendedHandleInformation) to find processes holding handles to lsass.exe with critical access rights such as PROCESS_VM_READ or PROCESS_ALL_ACCESS. It whitelists known system processes and flags unverified ones. Additionally, it reads the Process Environment Block (PEB) to inspect command lines for LOLBin-based dumping attempts (e.g., comsvcs.dll MiniDump, procdump). When configured, it can suspend suspicious processes using NtSuspendProcess to prevent memory dumps while preserving volatile memory for forensic analysis. The tool is intended as a free, transparent alternative to commercial EDRs for detecting credential dumping techniques.

Credential dumping from LSASS memory can expose sensitive user credentials, including Kerberos tickets and NTLM hashes, potentially allowing attackers to escalate privileges and move laterally within a Windows domain environment. MemGuard helps detect and mitigate these attacks by identifying unauthorized handle access and suspicious process behavior, reducing the risk of credential theft. However, it is a detection and mitigation tool rather than a vulnerability or exploit itself.

MemGuard provides active detection and mitigation capabilities for LSASS memory dumping attempts. It can be run in monitoring mode to alert on suspicious activity or in active mode to suspend offending processes, preserving forensic evidence. Since this is a defensive tool, no patch is applicable. Users should deploy MemGuard as part of their endpoint security strategy to complement existing protections. No vendor advisory or patch status applies.