Block credential stealing from the Windows local security authority subsystem
This registry value controls the attack surface reduction rule that protects the `lsass.exe` process (Local Security Authority Subsystem Service).
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
This registry value controls the attack surface reduction rule that protects the lsass.exe process (Local Security Authority Subsystem Service). It is a DWORD value, and value data 1 enables the rule in Block mode.
The rule prevents untrusted processes from reading LSASS process memory directly. When a process calls OpenProcess() and requests the PROCESS_VM_READ access right for lsass.exe, the rule denies that access. It does not prevent the requesting process from running altogether.
Notes
Security
LSASS handles Windows sign-ins and can hold security-sensitive credentials in memory. Preventing direct memory access makes it harder for malware and credential-dumping tools to extract data such as plaintext passwords or NTLM hashes.
The rule protects LSASS process memory specifically. It is not a general process, account, or access-control mechanism, and it does not prevent every method of credential theft or misuse.
Possible side effects
Legitimate applications that enumerate LSASS or attempt to open processes with extensive access rights can produce blocked-access events and substantial event-log noise. Such an event does not by itself indicate malicious activity.
Applications whose functionality genuinely depends on direct access to LSASS process memory can be affected. Microsoft specifically documents compatibility problems with Quest Dirsync Password Sync. For other applications, only an unnecessary LSASS access attempt might be blocked while the application's primary function continues normally.
Notes
The rule depends on Microsoft Defender Antivirus. Microsoft Defender Antivirus and real-time protection must be active for ASR rules to operate.
When Local Security Authority protection (LSA protection) is enabled, Microsoft states that this ASR rule provides no additional protection. The rule also does not support Warn mode and has limited exclusion support.
The rule is supported on Windows 10 version 1803 and later, Windows 11, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019 or later.
Microsoft documentation
Microsoft Learn: Attack surface reduction (ASR) rules reference
Microsoft Learn: Attack surface reduction frequently asked questions