Endpoint protection that detects attackers stealing saved passwords from a laptop's memory

For a Windows laptop, look for endpoint protection with credential-dumping / LSASS memory protection—not just antivirus.

Microsoft Defender for Endpoint is one option: its Attack Surface Reduction rule “Block credential stealing from the Windows local security authority subsystem (lsass.exe)” can block attempts to access LSASS memory, and Defender can detect suspicious credential-dumping behavior. (learn.microsoft.com)

Also enable Windows’ built-in LSA protection and, where supported, Credential Guard. These help prevent credential theft by restricting access to LSA/LSASS secrets; they complement endpoint detection rather than replacing it. (learn.microsoft.com)

One important distinction: if you mean passwords saved in a browser or password manager, rather than Windows sign-in credentials in LSASS, ask the vendor specifically about browser/password-manager credential theft—LSASS protections alone don’t cover every place saved passwords may be handled.

Several endpoint products detect this, and Microsoft Defender for Endpoint is the best-documented example.

Microsoft Defender for Endpoint

• It has a dedicated attack surface reduction (ASR) rule that blocks credential stealing from LSASS, the process that holds credentials in memory. Defender for Endpoint has advanced detections and a dedicated attack surface reduction rule (ASR) to block credential stealing from LSASS.
• In a 2022 AV-Comparatives test of LSASS dumping, it reported full detection and prevention across 15 test cases. Defender for Endpoint passed all 15 test cases used to dump user OS credentials from the LSASS process, achieving 100% detection and prevention scores. That result is from 2022, so treat it as dated rather than a current benchmark.
• It also watches behavior rather than just known tools. Microsoft Defender ATP instruments memory-related function calls such as VirtualAlloc and VirtualProtect to catch in-memory attack techniques like reflective DLL loading. The same signals can also be used to generically detect malicious credential dumping activities performed by a wide range of different individual tools.
• Setup note: a 2026 guide suggests running the rule in audit mode first. Run the rule in Audit mode for 7–14 days before switching to Block to detect any legitimate processes that access LSASS.

Other EDR platforms

• CrowdStrike Falcon and SentinelOne are commonly named for this job. One SOC analyst guide lists Detect LSASS access, credential dumping tools, and suspicious process chains in real time. CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint. I did not find independent, current test results for Falcon or SentinelOne in this search, so compare them directly before deciding.

Prevention alongside detection

• Detection works best with hardening that makes LSASS harder to read. On Windows 10 and later, enable Credential Guard (which uses virtualization to isolate secrets) and configure LSA as a protected process.

Limits

• Kernel-level attacks can slip past LSASS monitoring. One detection write-up notes that attackers with kernel driver access (signed/exploited driver) can read LSASS memory without generating a Sysmon Event 10 at all. Protections like Credential Guard and kernel-level controls help cover that gap.

If you tell me your environment (Windows version, whether you use Intune, and your budget), I can narrow this to one product and a rollout plan.

To protect against attackers stealing saved passwords and credentials from a laptop’s memory, you need an Endpoint Detection and Response (EDR) solution.

Modern EDR platforms are specifically designed to detect the behavioral patterns associated with "credential dumping"—the process of extracting authentication data (like NTLM hashes or plaintext passwords) from system memory.

How Endpoint Protection Detects Memory Theft

Attackers typically target the Local Security Authority Subsystem Service (LSASS) process (lsass.exe) on Windows, as it holds sensitive credentials in memory. Security solutions detect this through several layers:

• Behavioral Modeling: Rather than just looking for known malicious files, modern EDRs monitor "who" is accessing memory. They use statistical models to identify unauthorized processes attempting to read large amounts of data from lsass.exe—a behavior that is highly predictable for credential-stealing tools but anomalous for legitimate software.
• API Hooking & Telemetry: EDR agents "hook" into critical system functions (like VirtualAlloc or ReadProcessMemory). When a tool tries to use these functions to dump LSASS memory, the EDR agent intercepts the request, analyzes the intent, and blocks it if it looks malicious.
• Attack Surface Reduction (ASR): Solutions like Microsoft Defender for Endpoint include dedicated ASR rules specifically designed to block processes from requesting handle access to lsass.exe.
• Detection of "Living-off-the-Land" (LotL) Attacks: Attackers often use legitimate, signed Windows tools (like comsvcs.dll or procdump) to perform the theft. Advanced EDRs detect the context of these commands (e.g., why a normal process is suddenly invoking a memory dump command) rather than just blocking the tool itself.

Recommended Security Controls

To effectively secure your laptops, a combination of tools and configurations is best practice:

1. Deploy an EDR/XDR Solution: Use reputable platforms such as Microsoft Defender for Endpoint, CrowdStrike Falcon, Palo Alto Cortex XDR, or Elastic Security.
2. Enable Credential Guard: If using Windows, enable Windows Defender Credential Guard. It uses virtualization-based security to isolate secrets so that only privileged system software can access them, making it much harder for attackers to dump them from memory.
3. Harden LSASS: Enable built-in protections and ASR rules that restrict access to the LSASS process.
4. Adopt Zero Trust/Least Privilege: Ensure users do not run as local administrators unless necessary. Attackers generally need high-level privileges to successfully dump memory; limiting these privileges significantly narrows the attack surface.
5. Multi-Factor Authentication (MFA): While MFA does not prevent memory dumping, it ensures that if credentials are stolen, they are significantly less useful to an attacker trying to move laterally through your network.

For a Windows laptop, Microsoft Defender for Endpoint is a strong option: it can detect suspicious access to LSASS, the process that may hold sign-in credentials in memory, and block common credential-stealing attempts. ³⁴

For prevention, enable Defender’s “Block credential stealing from the Windows local security authority subsystem” attack surface reduction rule, plus LSA protection and Credential Guard where supported. Microsoft notes that LSA protection and Credential Guard are recommended protections; the rule can provide additional protection when those features aren’t enabled. ¹¹¹

CrowdStrike Falcon is another endpoint-protection option that says it detects and blocks credential-access behavior such as LSASS dumping. ⁶

One caveat: LSASS protection addresses a specific kind of memory-based credential theft. If you mean passwords saved in a browser or password manager, confirm the product specifically covers those apps and credential stores too; endpoint protection is not a guarantee that every saved password is protected.