T1003.004 LSA Secrets
Sub-technique of T1003 OS Credential Dumping
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- HackTool - Credential Dumping Tools Named Pipe Createdcriticaltest · windows
- Cred Dump Tools Dropped Fileshightest · windows
- Credential Dumping Tools Service Execution - Securityhightest · windows
- Credential Dumping Tools Service Execution - Systemhightest · windows
- DPAPI Domain Backup Key Extractionhightest · windows
- Dumping of Sensitive Hives Via Reg.EXEhightest · windows
- HackTool - Mimikatz Executionhightest · windows
- Mimikatz Usehightest · windows
- Possible Impacket SecretDump Remote Activityhightest · windows
- Possible Impacket SecretDump Remote Activity - Zeekhightest · zeek
- PUA - Memory Dump Mount Via MemProcFShighexperimental · windows
- DPAPI Domain Master Key Backup Attemptmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.