MITRE ATT&CKsub-technique

T1003.004 LSA Secrets

Published 2020-02-21 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Windows
Version
1.1
Created
2020-02-21

Description

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory. Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1003 OS Credential Dumping technique

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1017 User Training mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (20)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S1022 IceApple software (malware)
  • G1003 Ember Bear group
  • S0677 AADInternals software (tool)
  • S0488 CrackMapExec software (tool)
  • S0357 Impacket software (tool)
  • S0349 LaZagne software (tool)
  • G0077 Leafminer group
  • G0064 APT33 group
  • G0069 MuddyWater group
  • S0192 Pupy software (tool)
  • G0049 OilRig group
  • G0004 Ke3chang group
  • G0016 APT29 group
  • G0027 Threat Group-3390 group
  • G0035 Dragonfly group
  • G0045 menuPass group
  • S0002 Mimikatz software (tool)
  • S0008 gsecdump software (tool)
  • S0050 CosmicDuke software (malware)

Referenced by Compliance · mitigates (14)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References