T1003.004sub-technique of T1003 OS Credential Dumping
LSA Secrets
Windowsnothing on this site yetT1003.004 on attack.mitre.org
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at `HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets`. LSA secrets can also be dumped from memory. Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detection of LSA Secrets Dumping via Registry and Memory Extraction
- Detects adversary activity aimed at accessing LSA Secrets, including registry key export of HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets or memory scraping via tools such as Mimikatz or PowerSploit's Invoke-Mimikatz.
what reduces it
- M1017 User Training. Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
- M1027 Password Policies. Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
- M1026 Privileged Account Management. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.