t1003-004-lsa-secrets

name	T1003.004_lsa-secrets
description	Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service...
category	authentication
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1003.004","credential-access","windows","sub-technique"]
technique_id	T1003.004
tactic	credential-access
all_tactics	["credential-access"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1003/004
tech_stack	["windows"]
cwe_ids	["CWE-522"]
chains_with	["T1003","T1003.001","T1003.002","T1003.003","T1003.005","T1003.006","T1003.007","T1003.008"]
prerequisites	["T1003"]
severity_boost	{"T1003":"Chain with T1003 for deeper attack path","T1003.001":"Chain with T1003.001 for deeper attack path","T1003.002":"Chain with T1003.002 for deeper attack path"}

T1003.004 LSA Secrets

Sub-technique of: T1003

High-Level Description

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.

Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.

Kill Chain Phase

• Credential Access (TA0006)

Platforms: Windows

What to Check

• Identify if LSA Secrets technique is applicable to target environment
• Check Windows systems for indicators of LSA Secrets
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Dumping LSA Secrets

Dump secrets key from Windows registry When successful, the dumped file will be written to $env:Temp\secrets. Attackers may use the secrets key to assist with extracting passwords and enumerating other sensitive system information. https://pentestlab.blog/2018/04/04/dumping-clear-text-credentials/#:~:text=LSA%20Secrets%20is%20a%20registry,host%2C%20local%20security%20policy%20etc.

Supported Platforms: windows Elevation Required: Yes

"#{psexec_exe}" -accepteula -s reg save HKLM\security\policy\secrets %temp%\secrets /y

Dependencies:

• PsExec from Sysinternals must exist on disk at specified location (#{psexec_exe})

Atomic Test 2: Dump Kerberos Tickets from LSA using dumper.ps1

This tool allows you to dump Kerberos tickets from the LSA cache. Implemented via Add-Type. If the tool is run as a privileged user, it will automatically obtain NT AUTHORITY\SYSTEM privileges and then dump all tickets. If the tool is run as a non-privileged user, it will only dump tickets from the current logon session. Ref: Author of dumper.ps1: Michael Zhmaylo (@MzHmO)