Ember BearG1003 ↗
Has used frameworks such as Impacket to dump LSA secrets for credential capture.1
- Tactic
- Credential Access
- Platform
- Windows
- Version
- 1.1
- Created
- 21 February 2020
- Last modified
- 24 October 2025
- Contributor
- Ed Williams, Trustwave, SpiderLabs
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.[1][2][3] LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.[4]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
10
Threat groupsTop 19%
Threat groups81st percentile · 81% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.9
Tools & malware73rd pct
Tools & malware73rd percentile · 73% of ATT&CK techniques have this many tools implementing them or fewer.13
Detection rulesTop 19%
Detection rules81st percentile · 81% of ATT&CK techniques have this many detection rules written or fewer.LSA Secrets MITRE reference T1003.004
Top 19%of all ATT&CK techniques for number of groups
10 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
LeafminerG0077 ↗
Used several tools for retrieving login and password information, including LaZagne.1
APT33G0064 ↗
Has used a variety of publicly available tools like LaZagne to gather credentials.12
MuddyWaterG0069 ↗
OilRigG0049 ↗
Has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.1234
menuPassG0045 ↗
Has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.12
All 10 groups for this technique · 6 newest in this preview
9 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
IceAppleS1022 ↗
IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: HKLM\SECURITY\Policy\PolEKList\default, HKLM\SECURITY\Policy\Secrets\*\CurrVal, and HKLM\SECURITY\Policy\Secrets\*\OldVal.1
AADInternalsS0677 ↗
Can dump secrets from the Local Security Authority.1
CrackMapExecS0488 ↗
Can dump hashed passwords from LSA secrets for the targeted system.1
ImpacketS0357 ↗
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.1
LaZagneS0349 ↗
Can perform credential dumping from LSA secrets to obtain account and password information.1
PupyS0192 ↗
Can use Lazagne for harvesting credentials.1
All 9 software entries for this technique · 6 newest in this preview
Offense vs defense T1003.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 12Splunk ESCU (cumulative) · 1
first rule: 2017 Q1LSA Secrets detection strategy DET0437
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of LSA Secrets Dumping via Registry and Memory Extraction
1 platform
AN1212 · Windows
Detects adversary activity aimed at accessing LSA Secrets, including registry key export of HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets or memory scraping via tools such as Mimikatz or PowerSploit's Invoke-Mimikatz.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File ModificationDC0061 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetObject | Target registry paths like HKLM\SECURITY\Policy\Secrets or variants can be tuned depending on OS version or registry redirection settings. |
| ImageLoaded | Module names such as lsasrv.dll, sechost.dll, or suspicious DLLs loaded by user processes may require tuning for known-good service operations. |
| AccessMask | Tuning based on whether processes are using specific sensitive access rights (e.g., 0x2 or 0x4). |
| TimeWindow | Temporal window between registry access and command-line tool execution. |
Password PoliciesM1027
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
User TrainingM1017
Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
Tests2Executorscmd 1 · PowerShell 1Need elevation2 of 2Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition