inH1THM

Lsass

LSASS (Local Security Authority Subsystem Service)

  • Windows process: lsass.exe

  • Handles authentication (e.g., NTLM, Kerberos).

  • Stores password hashes in memory temporarily.

  • Target for credential dumping tools like Mimikatz.

which is responsible for create hash (NTLM Hash)

PreviousAuthenticationNextNTLM