A process, run by lsass.exe, that is responsible for enforcing the security policy on Windows OS.
This process verifies log on attempts of users and creates access tokens based on the user’s permissions levels.
It is also responsible to user account password changes.
Logging
The events associated with this process are logged within the Windows Security Log.
It is therefore a high-value target for privilege escalation as several tools exist to extract both cleartext and hashed credentials stored in memory by this process.