MITRE ATT&CK T1003.001 is the technique for OS Credential Dumping from LSASS memory on Windows. LSASS (the Local Security Authority Subsystem Service) stores and processes authentication material, so attackers try to read its memory to recover passwords, hashes, tickets, or reusable token data. This is a common post-compromise objective because it can turn one foothold into broader lateral movement and privilege escalation.
In real attacks, T1003.001 often appears as suspicious access to lsass.exe, injection into LSASS, use of debug or dump APIs, or creation of memory dumps for offline analysis. Defenders monitor for these behaviors with EDR, process access alerts, and endpoint hardening controls such as LSA protection, Credential Guard, and attack surface reduction rules. The technique matters because it describes a well-known tradecraft pattern, not a single malware family, so detection must focus on behavior and system protections rather than file signatures alone.