T1003.004: LSA Secrets
Summary
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)
Source Attribution
Source: MITRE ATT&CK · Confidence: high
Platforms
- Windows
Tactic
credential-access
References
- https://attack.mitre.org/techniques/T1003/004
- https://www.first.org/resources/papers/conf2017/Windows-Credentials-Attacks-and-Mitigation-Techniques.pdf
- https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets
- https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material?redirectedfrom=MSDN
- https://www.passcape.com/index.php?section=docsys&cmd=details&id=23
- https://github.com/mattifestation/PowerSploit