自动化接入 · API / MCP EN

技术说明 · T1003.004

LSA Secrets

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory. Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.

ATT&CK T1003.004 platforms — 状态 有效 版本 20.1

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.123 LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.4 Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.5

  1. Passcape LSA Secrets
  2. Microsoft AD Admin Tier Model
  3. Tilbury Windows Credentials
  4. ired Dumping LSA Secrets
  5. ired Dumping LSA Secrets

使用该技术的组织

组织名称国家
grp_g0064APT33Iran
grp_g0004Ke3chang—
grp_g0077LeafminerIran
grp_g0035DragonflyRussia
grp_g0049OilRigIran
grp_g0069MuddyWater—
grp_g1003Ember BearRussia
grp_g0045menuPass—
grp_g0016APT29Russia
grp_g0027Threat Group-3390China

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。