Automation · API / MCP 中文

Technique note · T1003.004

LSA Secrets

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory. Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.

ATT&CK T1003.004 platforms — Status Active Version 20.1

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.123 LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.4 Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.5

  1. Passcape LSA Secrets
  2. Microsoft AD Admin Tier Model
  3. Tilbury Windows Credentials
  4. ired Dumping LSA Secrets
  5. ired Dumping LSA Secrets

Groups using this technique

GroupNameCountry
grp_g0064APT33Iran
grp_g0004Ke3chang—
grp_g0077LeafminerIran
grp_g0035DragonflyRussia
grp_g0049OilRigIran
grp_g0069MuddyWater—
grp_g1003Ember BearRussia
grp_g0045menuPass—
grp_g0016APT29Russia
grp_g0027Threat Group-3390China

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.