LsaIso.exe
Sources: 300M+ executions observed in the wild.
Summary
LSA Isolated (Credential Guard). Runs in a Hyper-V isolated Virtual Secure Mode (VSM) to protect credential material (NTLM hashes, Kerberos tickets) from being extracted by attackers, even with SYSTEM access.
LsaIso.exe is the 2287th most commonly executed Windows program in EchoTrail's dataset, observed 216 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by wininit.exe.
Get this in your tools
The same record for lsaiso.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/lsaiso.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 5c8006cad3834528025f6d9ce308ea68e6d759a4166b4a3e6de03297490e3eed15.28%
- 89b23f83b0f5b08ca286de2a6e650729a8652230938447d9a0d3f3d815d41bb410.65%
- 74d594864655f53d659edff569844c8da622da8e6b4391906f14c73d7496c7fc9.72%
- 2a1b79bdafdce022d4c21ef372768a94ce03d80e2a5bdd4119ab946230ffdf6f8.33%
- 713f349e67b8af9de1aa157e1b7fa69b8b899fead9a518630bae7defb164eb677.41%
- 0b2b77b28fd6931b3b49435e3736433df7941a579debfd130473129d7af3a3ab6.94%
- c16a46ab3f282f34f829d4fa8905594e469a09a2dddadb525e67d121a6310ee86.48%
- d9252660b149c2ddc98004e2e0b5c56117ecce67b12a27452770f89f5039942d5.56%
- 4224814b61f12b7e4fca30010d83b668021d81db6d2b9e45c32d591bc32199875.09%
- 227085d91adf5478d72442f2c7adf1438e3fcca60ebccf46ce57d1cf5254bf444.63%
Process Ancestry
Top Parents
- wininit.exe100%
Security Analysis
What does LsaIso.exe normally do?
Runs from C:\Windows\System32. Present only on systems with Credential Guard enabled (requires Hyper-V, UEFI Secure Boot). Runs in an isolated process within Virtual Secure Mode. Should always be running when Credential Guard is active. Single instance.
When is LsaIso.exe suspicious?
lsaiso.exe not running on a system where Credential Guard is expected. Multiple instances. Running from a non-System32 path. Any process attempting to access or read lsaiso.exe memory.
How do attackers abuse LsaIso.exe?
lsaiso.exe is a defensive control, not an attack tool. Its presence indicates Credential Guard is active, which prevents most credential dumping techniques (Mimikatz, LSASS memory access). Attackers may attempt to disable Credential Guard via: - bcdedit modifications to disable hypervisor - Disabling VBS (Virtualization-Based Security) via Group Policy - Exploiting hypervisor vulnerabilities to escape VSM Absence of lsaiso.exe on systems that should have Credential Guard is itself an indicator of tampering.
Detection guidance
MONITOR FOR: - Credential Guard being disabled (bcdedit changes to hypervisorlaunchtype, VBS policy changes) - lsaiso.exe stopping unexpectedly on Credential Guard-enabled systems - Processes attempting to read lsaiso.exe memory DATA SOURCES: Process creation/termination (Sysmon 1/5), registry events for VBS policy
False positive notes
Not present on systems without Credential Guard (Windows 10/11 Enterprise with Hyper-V). VMs may not support Credential Guard depending on hypervisor configuration.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about LsaIso.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for LsaIso.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.