ISASS.exe is usually suspicious because the real Windows process is named lsass.exe, with a lowercase “L,” not a capital “I.” That tiny letter trick is a classic malware costume. Windows does run a real security process called Local Security Authority Subsystem Service. But its file name should be lsass.exe, and it should live in C:\Windows\System32.

TLDR: If you see ISASS.exe, treat it like a raccoon wearing a security guard hat. The real Windows process is lsass.exe, and it normally runs from C:\Windows\System32 as SYSTEM. For example, if “ISASS.exe” is running from AppData, using 18% CPU, and making 47 outbound connections, isolate the device and investigate fast. Do not kill the real lsass.exe, because Windows may crash or log you out.

Why This Name Is So Sneaky

The trick is simple. Malware authors know that l and I look almost the same in many fonts.

• lsass.exe starts with a lowercase “L.” This is the real Windows process.
• ISASS.exe starts with a capital “I.” This is often fake.
• 1sass.exe starts with the number one. Also sketchy.
• lsas.exe is missing a letter. Nope.

It drives me crazy that one tiny character can hide malware in plain sight. But that is the whole game. The attacker wants you to glance, shrug, and move on.

What the Real lsass.exe Does

lsass.exe is not junk. It is one of the most sensitive Windows processes.

It handles:

• User logins.
• Password checks.
• Security tokens.
• Domain authentication.
• Kerberos and NTLM activity.

In plain English, lsass.exe helps Windows decide who you are and what you can access. That makes it a juicy target. Attackers love it because stolen credentials can open the next door, then the next one, then the next one. Annoying? Yes. Effective? Also yes.

Quick Checks: Real or Suspicious?

Start with these checks. They are simple and fast.

1. Check the spelling

The real file is:

lsass.exe

Read it slowly. It begins with lowercase L. If you see ISASS.exe, lsasss.exe, or lsaass.exe, that is suspicious.

2. Check the file location

The running real process should be here:

C:\Windows\System32\lsass.exe

Bad locations include:

• C:\Users\Name\AppData\Roaming
• C:\Users\Name\AppData\Local\Temp
• C:\ProgramData
• Downloads
• Desktop
• Any random folder with a “Windows” looking name

Malware often hides in boring folders. It hopes nobody checks. Sorry, little gremlin. We check.

3. Check the publisher

Right click the file. Open Properties. Then check Digital Signatures.

A legitimate file should be signed by Microsoft. You may see names like:

• Microsoft Windows
• Microsoft Windows Publisher

If there is no signature, or the signer looks odd, raise the alarm.

4. Check the user account

The real process runs as:

SYSTEM

If a fake “ISASS.exe” runs under your user account, that is another bad sign.

5. Check how many are running

Usually, you should see one real lsass.exe process. If you see two similar names, slow down and compare them.

One may be real. One may be a copycat.

How to Inspect It in Task Manager

Task Manager is the easy first stop. It is not perfect. Sometimes it hides useful details until you click too much. Expect to waste an extra 10 seconds opening columns that should already be visible. Classic.

1. Press Ctrl + Shift + Esc.
2. Click Details.
3. Find lsass.exe or anything that looks like it.
4. Right click the process.
5. Choose Open file location.
6. Check the folder path.

If it opens C:\Windows\System32, that is a good sign. If it opens AppData or Temp, that is not good.

Better Tools for Investigation

Use these if you want a cleaner view.

• Microsoft Process Explorer: Great for checking signatures, parent processes, and command lines.
• Autoruns: Great for finding startup entries that bring malware back after reboot.
• PowerShell: Good for quick checks across one machine or many machines.
• Windows Defender: Built in. Run a full scan or offline scan.
• Event Viewer: Useful for login events and odd service activity.
• Sysmon: Excellent if it was already installed before the infection.

A handy PowerShell command is:

Get-Process lsass | Select-Object Name, Id, Path

You can also look for copycats:

Get-Process | Where-Object {$_.Name -match "sass|lsas|isass"}

If PowerShell shows a suspicious path, do not celebrate yet. Confirm it. Then collect evidence.

Red Flags That Suggest Malware

Watch for these signs:

• The name is ISASS.exe instead of lsass.exe.
• The file runs from AppData, Temp, or ProgramData.
• The file has no Microsoft signature.
• The process uses strange network connections.
• CPU usage stays high for no clear reason.
• It starts again after you remove it.
• It creates scheduled tasks or services.
• Your antivirus flags it as a Trojan, stealer, or worm.

One red flag may be a mistake. Three red flags are a problem. Five red flags mean the raccoon has keys to the building.

Network Activity: Normal or Not?

On a domain joined work computer, real lsass.exe may talk to domain controllers. That can be normal. It may use authentication related traffic.

On a home laptop, constant outbound traffic from a fake ISASS.exe is not normal. Connections to unknown IP addresses are especially suspicious.

Check with:

• Resource Monitor
• TCPView
• Windows Defender Firewall logs
• EDR console, if your company uses one

What Not to Do

Do not randomly delete C:\Windows\System32\lsass.exe. That is the real Windows file. You can break the system.

Do not blindly end the real process either. Windows treats it as critical. Killing it can force a shutdown or crash.

Do not upload sensitive memory dumps to public sites. LSASS memory can contain secrets. That includes password material and tokens.

What to Do If ISASS.exe Looks Malicious

1. Disconnect from the network. Pull Wi Fi or unplug Ethernet.
2. Take screenshots. Capture name, path, PID, user, and network connections.
3. Copy the file hash. Use PowerShell: Get-FileHash "path\file.exe".
4. Scan with Defender. Use a full scan or offline scan.
5. Check startup points. Use Autoruns or Task Scheduler.
6. Reset passwords from a clean device. Start with admin and email accounts.
7. Patch Windows. Malware loves stale systems.
8. Call your security team if this is a work machine.

Simple Final Rule

Real: lsass.exe, Microsoft signed, running as SYSTEM, from C:\Windows\System32.

Suspicious: ISASS.exe, odd spelling, strange folder, unknown signature, weird network traffic, or repeated startup behavior.

The name game is annoying, but the checks are not hard. Verify the spelling. Verify the path. Verify the signature. If the file fails those tests, treat it like malware until proven clean.