CmdID / Techniques / T1003

T1003.004 OS Credential Dumping: LSA Secrets

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. MITRE ATT&CK

1 program on CmdID 3 Sigma rules T1003.004 on attack.mitre.org

Part of

MITRE ATT&CK

T1003OS Credential Dumping

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

reg.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highDumping of Sensitive Hives Via Reg.EXETeymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113 · Windows

highHackTool - Mimikatz ExecutionTeymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton · Windows

highPUA - Memory Dump Mount Via MemProcFSSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Run mimikatz in interactive mode on the page for mimikatz

mimikatzIdentify

Enable debug privileges (needed for most operations) on the page for mimikatz

mimikatz "privilege::debug"Identify

Dump plaintext passwords, NTLM hashes, and Kerberos tickets from memory on the page for mimikatz

mimikatz "sekurlsa::logonpasswords"Identify

Pass-the-Hash with a specific NTLM hash and launch a command on the page for mimikatz

mimikatz "sekurlsa::pth /user:username /domain:domain /ntlm:hash /run:cmd"Identify

Dump local SAM database hashes on the page for mimikatz

mimikatz "lsadump::sam"Identify

Extract Kerberos tickets and export to a file on the page for mimikatz

mimikatz "kerberos::list /export"Identify

List cryptographic providers on the page for mimikatz-crypto

mimikatz "crypto::providers"Identify

List keys in a cryptographic provider on the page for mimikatz-crypto

mimikatz "crypto::capi"Identify

Export certificates and keys on the page for mimikatz-crypto

mimikatz "crypto::certificates /export"Identify

List master keys on the page for mimikatz-dpapi

mimikatz "dpapi::masterkey /list"Identify

Decrypt a DPAPI blob on the page for mimikatz-dpapi

mimikatz "dpapi::blob /in:blob_file.bin"Identify

Retrieve Chrome credentials using DPAPI on the page for mimikatz-dpapi

mimikatz "dpapi::chrome /in:Login Data"Identify

And 29 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1003.004: a Sigma rule it trips is tagged with it, or its abuse is documented as it.