OS Credential Dumping: LSA Secrets

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.[1][2][3] LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.[4]

Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.[4]

ID: T1003.004
Sub-technique of:  T1003
Platforms: Windows
Permissions Required: SYSTEM
Contributors: Ed Williams, Trustwave, SpiderLabs
Version: 1.0
Created: 21 February 2020
Last Modified: 21 April 2021

Procedure Examples

ID Name Description
S0677 AADInternals

AADInternals can dump secrets from the Local Security Authority.[5]

G0016 APT29

APT29 has used the reg save command to extract LSA secrets offline.[6]

G0064 APT33

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[7][8]

S0050 CosmicDuke

CosmicDuke collects LSA secrets.[9]

S0488 CrackMapExec

CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.[10]

G0035 Dragonfly

Dragonfly has dropped and executed SecretsDump to dump password hashes.[11][12]

S0008 gsecdump

gsecdump can dump LSA secrets.[13]

S1022 IceApple

IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: HKLM\SECURITY\Policy\PolEKList\default, HKLM\SECURITY\Policy\Secrets\*\CurrVal, and HKLM\SECURITY\Policy\Secrets\*\OldVal.[14]

S0357 Impacket

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.[15]

G0004 Ke3chang

Ke3chang has dumped credentials, including by using gsecdump.[16][17]

S0349 LaZagne

LaZagne can perform credential dumping from LSA secrets to obtain account and password information.[18]

G0077 Leafminer

Leafminer used several tools for retrieving login and password information, including LaZagne.[19]

G0045 menuPass

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.[20][21]

S0002 Mimikatz

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA.[22][23][24][25]

G0069 MuddyWater

MuddyWater has performed credential dumping with LaZagne.[26][27]

G0049 OilRig

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.[28][29][30][31]

S0192 Pupy

Pupy can use Lazagne for harvesting credentials.[32]

G0027 Threat Group-3390

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.[33][34]

Mitigations

ID Mitigation Description
M1027 Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

M1026 Privileged Account Management

Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.[3]

M1017 User Training

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that may access to a host may attempt to access Local Security Authority (LSA) secrets. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,[35] which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

DS0024 Windows Registry Windows Registry Key Access

Monitor for the LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets being accessed

References

  1. Passcape. (n.d.). Windows LSA secrets. Retrieved February 21, 2020.
  2. Microsoft. (2019, February 14). Active Directory administrative tier model. Retrieved February 21, 2020.
  3. Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack, Mitigation, Defense. Retrieved February 21, 2020.
  4. Mantvydas Baranauskas. (2019, November 16). Dumping LSA Secrets. Retrieved February 21, 2020.
  5. Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022.
  6. Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.
  7. Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
  8. Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.
  9. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  10. byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.
  11. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  12. Core Security. (n.d.). Impacket. Retrieved November 2, 2017.
  13. TrueSec. (n.d.). gsecdump v2.0b5. Retrieved September 29, 2015.
  14. CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022.
  15. SecureAuth. (n.d.). Retrieved January 15, 2019.
  16. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  17. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  18. Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018.
  1. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
  2. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  3. Twi1ight. (2015, July 11). AD-Pentest-Script - wmiexec.vbs. Retrieved June 29, 2017.
  4. Deply, B. (n.d.). Mimikatz. Retrieved September 29, 2015.
  5. Deply, B., Le Toux, V. (2016, June 5). module ~ lsadump. Retrieved August 7, 2017.
  6. Grafnetter, M. (2015, October 26). Retrieving DPAPI Backup Keys from Active Directory. Retrieved December 19, 2017.
  7. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
  8. Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018.
  9. Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.
  10. Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023.
  11. Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.
  12. Mandiant. (2018). Mandiant M-Trends 2018. Retrieved July 9, 2018.
  13. Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019.
  14. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  15. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
  16. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  17. PowerSploit. (n.d.). Retrieved December 4, 2014.