LSA Secrets
Parent: T1003
Description
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)
Mapped SPARTA techniques
No techniques mapped to this control.
Cross-framework references
Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.
Countered by 13 in MITRE D3FEND (Defensive Techniques)
- D3-ABPIApplication-based Process Isolation
- D3-DIData Inventory
- D3-HBPIHardware-based Process Isolation
- D3-HRHost Reboot
- D3-HSHost Shutdown
- D3-KBPIKernel-based Process Isolation
- D3-PLAProcess Lineage Analysis
- D3-PSProcess Suspension
- D3-PSAProcess Spawn Analysis
- D3-PSMDProcess Self-Modification Detection
- D3-PTProcess Termination
- D3-RDRestore Database
- D3-SCFSystem Call Filtering
Cite as SafeMode Space, mitre-attack-enterprise T1003.004.