Shulou(Shulou.com)11/24 Report--

CTOnews.com, September 10 (Xinhua)-- Security assessment company AV-Comparatives has tested LSASS credential dump protection for enterprise-class anti-malware solutions. Among the products tested, Microsoft's Defender for Endpoint got full marks.

A brief introduction to the dump credentials in LSASS (Local Security Authority Subsystem Service): LSASS is a process in the Windows operating system that enforces security policies on the system. It authenticates users who log in to the Windows computer or server, handles password changes, and creates access tokens. After the user logs in, various credentials are generated and stored in the local security authorization subsystem service LSASS process in memory so that the user does not have to log in repeatedly each time they access system resources.

For this reason, attackers often use the LSASS process to steal useful credentials from domain users through dumps. And then use it to run rampant within the target network.

In this test, testers used 15 different attack methods, and Defender for Endpoint stopped them well. In addition, Avast Ultimate Business Security, Bitdefender GravityZone Business Security Enterprise and Kaspersky EDR Expert also passed the test perfectly.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.