Skip to content

S0121 Lslsass

Lslsass is a publicly-available tool that can dump active logon session password hashes from the lsass process. 1

Item Value
ID S0121
Associated Names
Type TOOL
Version 1.1
Created 31 May 2017
Last Modified 30 March 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1003 OS Credential Dumping -
enterprise T1003.001 LSASS Memory Lslsass can dump active logon session password hashes from the lsass process.1

Groups That Use This Software

ID Name References
G0006 APT1 1

References

Back to top