{"T1003":"Chain with T1003 for deeper attack path","T1003.002":"Chain with T1003.002 for deeper attack path","T1003.003":"Chain with T1003.003 for deeper attack path"}
T1003.001 LSASS Memory
Sub-technique of: T1003
High-Level Description
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
For example, on the target host use procdump:
procdump -ma lsass.exe lsass_dump
Locally, mimikatz can be run using:
sekurlsa::Minidump lsassdump.dmp
sekurlsa::logonPasswords
Built-in Windows tools such as comsvcs.dll can also be used:
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full
Similar to Image File Execution Options Injection, the silent process exit mechanism can be abused to create a memory dump of lsass.exe through Windows Error Reporting (WerFault.exe).
Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.
The following SSPs can be used to access credentials:
Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.
Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.
Kill Chain Phase
Credential Access (TA0006)
Windows
Platforms:
What to Check
Identify if LSASS Memory technique is applicable to target environment
Check Windows systems for indicators of LSASS Memory
Verify mitigations are bypassed or absent (7 known mitigations)
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Dump LSASS.exe Memory using ProcDump
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump.
Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.
If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the get-prereq_commands to download and install the ProcDump tool first.
Supported Platforms: windows
Elevation Required: Yes
NanoDump executable must exist on disk at specified location (PathToAtomicsFolder..\ExternalPayloads\nanodump.x64.exe)
Atomic Test 5: Dump LSASS.exe Memory using Windows Task Manager
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task
Manager and administrative permissions.
Supported Platforms: windows
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to LSASS Memory by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1003.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
M1028 Operating System Configuration
Consider disabling or restricting NTLM. Consider disabling WDigest authentication.
M1043 Credential Access Protection
With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.
M1025 Privileged Process Integrity
On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.
M1026 Privileged Account Management
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
M1017 User Training
Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
M1040 Behavior Prevention on Endpoint
On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.
M1027 Password Policies
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
Detection
Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence
