Credential theft warnings: what to check first

Overview

Alerts mentioning LSASS access, token theft, or Mimikatz-like behavior require fast triage. This checklist reduces false positives and catches real intrusions early.

First five checks

1. Parent process: is it a known patch management, backup, or monitoring agent?
2. Signer and path: is binary in Program Files with valid signature?
3. Prevalence: single machine vs many—widespread may indicate broken update or mass false positive.
4. User context: service account vs interactive admin?
5. Time correlation: change tickets, logons from new geos, VPN anomalies.

Escalate immediately if

• Unsigned PowerShell downloading second-stage payloads.
• New local admins created.
• RDP lateral movement chains from the same source IP.

Containment fast path

Isolate host, disable compromised accounts’ sessions, and force password resets for any account with secrets on that device.

Post-incident hygiene

• Review Protected Users / tiering for high-risk accounts.
• Confirm ASR rules blocking credential theft are not in audit-only due to fear of noise.

Notes for helpdesk

Do not ask the user to “ignore” credential alerts without analyst review.