Skip to content

T1003.001 LSASS Memory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.

For example, on the target host use procdump:

  • procdump -ma lsass.exe lsass_dump

Locally, mimikatz can be run using:

  • sekurlsa::Minidump lsassdump.dmp
  • sekurlsa::logonPasswords

Built-in Windows tools such as comsvcs.dll can also be used:

  • rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full35

Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user’s Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.2

The following SSPs can be used to access credentials:

  • Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
  • Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.6
  • Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
  • CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.6
Item Value
ID T1003.001
Sub-techniques T1003.001, T1003.002, T1003.003, T1003.004, T1003.005, T1003.006, T1003.007, T1003.008
Tactics TA0006
Platforms Windows
Version 1.2
Created 11 February 2020
Last Modified 03 April 2023

Procedure Examples

ID Name Description
C0025 2016 Ukraine Electric Power Attack During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.95
G0006 APT1 APT1 has been known to use credential dumping using Mimikatz.21
G0007 APT28 APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.9192 They have also dumped the LSASS process memory using the MiniDump function.93
G0022 APT3 APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument “dig.”51
G0050 APT32 APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.8788
G0064 APT33 APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.8182
G0087 APT39 APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.58
G0096 APT41 APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.8384
G0143 Aquatic Panda Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.65
S0606 Bad Rabbit Bad Rabbit has used Mimikatz to harvest credentials from the victim’s machine.34
G0108 Blue Mockingbird Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.54
G0060 BRONZE BUTLER BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.86
G0003 Cleaver Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.33
S0154 Cobalt Strike Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.32
S0046 CozyCar CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.29
S0187 Daserf Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.30
G1006 Earth Lusca Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.59
S0367 Emotet Emotet has been observed dropping password grabber modules including Mimikatz. 40
S0363 Empire Empire contains an implementation of Mimikatz to gather credentials from memory.15
G0037 FIN6 FIN6 has used Windows Credential Editor for credential dumping.5253
G0061 FIN8 FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).89
G0117 Fox Kitten Fox Kitten has used prodump to dump credentials from LSASS.61
G0093 GALLIUM GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.7576
S0342 GreyEnergy GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.39
G0125 HAFNIUM HAFNIUM has used procdump to dump the LSASS process memory.44343
S0357 Impacket SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.26
G0119 Indrik Spider Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.45
G0004 Ke3chang Ke3chang has dumped credentials, including by using Mimikatz.646362
G0094 Kimsuky Kimsuky has gathered credentials using Mimikatz and ProcDump.565557
S0349 LaZagne LaZagne can perform credential dumping from memory to obtain account and password information.23
G0077 Leafminer Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.85
G0065 Leviathan Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.60
S0681 Lizar Lizar can run Mimikatz to harvest credentials.4142
S0121 Lslsass Lslsass can dump active logon session password hashes from the lsass process.21
S1060 Mafalda Mafalda can dump password hashes from LSASS.exe.31
G0059 Magic Hound Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.48737274
S0002 Mimikatz Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.16171819
G0069 MuddyWater MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.686970
S0056 Net Crawler Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.33
S0368 NotPetya NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.353619
G0049 OilRig OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.49474846
S0439 Okrum Okrum was seen using MimikatzLite to perform credential dumping.37
S0365 Olympic Destroyer Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.38
C0014 Operation Wocao During Operation Wocao, threat actors used ProcDump to dump credentials from memory.94
G0068 PLATINUM PLATINUM has used keyloggers that are also capable of dumping credentials.50
S0428 PoetRAT PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.27
S0378 PoshC2 PoshC2 contains an implementation of Mimikatz to gather credentials from memory.20
S0194 PowerSploit PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.2425
S0192 Pupy Pupy can execute Lazagne as well as Mimikatz using PowerShell.13
S0583 Pysa Pysa can perform OS credential dumping using Mimikatz.28
G0034 Sandworm Team Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.787980
G0091 Silence Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.77
S0692 SILENTTRINITY SILENTTRINITY can create a memory dump of LSASS via the MiniDumpWriteDump Win32 API call.14
G0088 TEMP.Veles TEMP.Veles has used Mimikatz and a custom tool, SecHack, to harvest credentials. 71
G0027 Threat Group-3390 Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.6667
G0107 Whitefly Whitefly has used Mimikatz to obtain credentials.90
S0005 Windows Credential Editor Windows Credential Editor can dump credentials.22

Mitigations

ID Mitigation Description
M1040 Behavior Prevention on Endpoint On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing. 7
M1043 Credential Access Protection With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.910
M1028 Operating System Configuration Consider disabling or restricting NTLM.11 Consider disabling WDigest authentication.12
M1027 Password Policies Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
M1026 Privileged Account Management Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
M1025 Privileged Process Integrity On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.8
M1017 User Training Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process OS API Execution

References

  1. French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019. ↩

  2. Graeber, M. (2014, October). Analysis of Malicious Security Support Provider DLLs. Retrieved March 1, 2017. ↩

  3. Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021. ↩↩

  4. PowerSploit. (n.d.). Retrieved December 4, 2014. ↩

  5. Symantec. (2021, June 10). Attacks Against the Government Sector. Retrieved September 28, 2021. ↩

  6. Wilson, B. (2016, April 18). The Importance of KB2871997 and KB2928120 for Credential Protection. Retrieved April 11, 2018. ↩↩

  7. Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021. ↩

  8. Microsoft. (2013, July 31). Configuring Additional LSA Protection. Retrieved February 13, 2015. ↩

  9. Lich, B. (2016, May 31). Protect derived domain credentials with Credential Guard. Retrieved June 1, 2016. ↩

  10. NSA IAD. (2017, April 20). Secure Host Baseline - Credential Guard. Retrieved April 25, 2017. ↩

  11. Microsoft. (2012, November 29). Using security policies to restrict NTLM traffic. Retrieved December 4, 2017. ↩

  12. Microsoft. (2014, May 13). Microsoft Security Advisory: Update to improve credentials protection and management. Retrieved June 8, 2020. ↩

  13. Nicolas Verdier. (n.d.). Retrieved January 29, 2018. ↩

  14. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩

  15. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. ↩

  16. Deply, B. (n.d.). Mimikatz. Retrieved September 29, 2015. ↩

  17. Deply, B., Le Toux, V. (2016, June 5). module ~ lsadump. Retrieved August 7, 2017. ↩

  18. Grafnetter, M. (2015, October 26). Retrieving DPAPI Backup Keys from Active Directory. Retrieved December 19, 2017. ↩

  19. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019. ↩↩

  20. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  21. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016. ↩↩

  22. Amplia Security. (n.d.). Windows Credentials Editor (WCE) F.A.Q.. Retrieved December 17, 2015. ↩

  23. Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018. ↩

  24. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018. ↩

  25. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018. ↩

  26. SecureAuth. (n.d.). Retrieved January 15, 2019. ↩

  27. Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020. ↩

  28. CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021. ↩

  29. F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015. ↩

  30. DiMaggio, J. (2016, April 28). Tick cyberespionage group zeros in on Japan. Retrieved July 16, 2018. ↩

  31. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023. ↩

  32. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  33. Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017. ↩↩

  34. M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021. ↩

  35. Chiu, A. (2016, June 27). New Ransomware Variant “Nyetya” Compromises Systems Worldwide. Retrieved March 26, 2019. ↩

  36. US-CERT. (2017, July 1). Alert (TA17-181A): Petya Ransomware. Retrieved March 15, 2019. ↩

  37. Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020. ↩

  38. Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019. ↩

  39. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018. ↩

  40. Trend Micro. (2019, January 16). Exploring Emotet’s Activities . Retrieved March 25, 2019. ↩

  41. Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022. ↩

  42. BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022. ↩

  43. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022. ↩

  44. MSTIC. (2021, March 2). HAFNIUM targeting Exchange Servers with 0-day exploits. Retrieved March 3, 2021. ↩

  45. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021. ↩

  46. Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019. ↩

  47. Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017. ↩

  48. Mandiant. (2018). Mandiant M-Trends 2018. Retrieved July 9, 2018. ↩↩

  49. Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023. ↩

  50. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018. ↩

  51. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016. ↩

  52. FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016. ↩

  53. McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. ↩

  54. Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020. ↩

  55. ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019. ↩

  56. CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020. ↩

  57. KISA. (n.d.). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 7, 2022. ↩

  58. Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019. ↩

  59. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022. ↩

  60. Plan, F., et al. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019. ↩

  61. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩

  62. MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022. ↩

  63. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018. ↩

  64. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014. ↩

  65. Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022. ↩

  66. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. ↩

  67. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017. ↩

  68. Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018. ↩

  69. Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018. ↩

  70. Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021. ↩

  71. Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019. ↩

  72. DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023. ↩

  73. DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022. ↩

  74. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019. ↩

  75. MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021. ↩

  76. Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020. ↩

  77. Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020. ↩

  78. Cherepanov, A.. (2017, June 30). TeleBots are back: Supply chain attacks against Ukraine. Retrieved June 11, 2020. ↩

  79. MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023. ↩

  80. Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019. ↩

  81. Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019. ↩

  82. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩

  83. Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021. ↩

  84. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018. ↩

  85. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018. ↩

  86. Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018. ↩

  87. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. ↩

  88. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018. ↩

  89. Symantec. (2019, March 6). Whitefly: Espionage Group has Singapore in Its Sights. Retrieved May 26, 2020. ↩

  90. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016. ↩

  91. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018. ↩

  92. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021. ↩

  93. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  94. Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020. ↩