Techniques › T1003 › T1003.004
T1003.004 LSA Secrets
credential access — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
12
Sigma rules tagged attack.t1003.004
0
KEV CVEs mapped here
<p>Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.</p><p>Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0437 Detection of LSA Secrets Dumping via Registry and Memory Extraction v1.0
AN1212 WindowsDetects adversary activity aimed at accessing LSA Secrets, including registry key export of HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets or memory scraping via tools such as Mimikatz or PowerSploit's Invoke-Mimikatz.Tunable:
TargetObjectImageLoadedAccessMaskTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1003.004
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2017-01-10 (modified 2022-01-05) · logsource: product=windows · 06d71506-7beb-4f22-8888-e2e5e2ca7fd8
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Author: Samir Bousseaden, wagga
· 2019-04-03 (modified 2022-08-11) · logsource: product=windows service=security · 252902e3-5830-4cf6-bf21-c22083dfd5cf
Detect AD credential dumping using impacket secretdump HKTL
Author: Roberto Rodriguez @Cyb3rWard0g
· 2019-08-10 (modified 2023-03-15) · logsource: product=windows service=security · 39a94fd1-8c9a-4ff6-bf22-c058762f8014
Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2017-03-05 (modified 2022-11-29) · logsource: product=windows service=system · 4976aa50-8f41-45c6-8b15-ab3fc10e79ed
Detects well-known credential dumping tools execution via service execution events
Author: Roberto Rodriguez @Cyb3rWard0g
· 2019-06-20 (modified 2022-02-24) · logsource: product=windows service=security · 4ac1f50b-3bd0-4968-902d-868b4647937e
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-27 · logsource: product=windows category=process_creation · 8a1b2c3d-4e5f-6789-abcd-ef1234567890
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
Author: Teymur Kheirkhabarov, oscd.community
· 2019-11-01 (modified 2025-10-25) · logsource: product=windows category=file_event · 8fbf3271-1ef6-4e94-8210-03c2317947f6
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Author: Samir Bousseaden, @neu5ron
· 2020-03-19 (modified 2021-11-27) · logsource: product=zeek service=smb_files · 92dae1ed-1c9d-4eff-a567-33acbd95b00e
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
Author: Teymur Kheirkhabarov, oscd.community
· 2019-11-01 (modified 2023-08-07) · logsource: product=windows category=pipe_created · 961d0ba2-3eea-4303-a930-2cf78bbfcc5e
Detects well-known credential dumping tools execution via specific named pipe creation
Author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton
· 2019-10-22 (modified 2023-02-21) · logsource: product=windows category=process_creation · a642964e-bead-4bed-8910-1bb4d63e3b4d
Detection well-known mimikatz command line arguments
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2017-03-05 (modified 2022-11-29) · logsource: product=windows service=security · f0d1feba-4344-4ca9-8121-a6c97bd6df52
Detects well-known credential dumping tools execution via service execution events
Author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113
· 2019-10-22 (modified 2023-12-13) · logsource: product=windows category=process_creation · fd877b94-9bb5-4191-bb25-d79cbd93c167
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Rules tagged at the parent level (attack.t1003) 37
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0442defa-b4a2-41c9-ae2c-ea7042fc4701
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 · logsource: product=windows category=ps_script · 189e3b02-82b2-4b90-9662-411eb64486d4
Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.
Author: Thomas Patzke
· 2017-06-14 (modified 2025-01-30) · logsource: product=windows service=security · 1de68c67-af5c-4097-9c85-fe5578e09e67
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Author: Florian Roth (Nextron Systems)
· 2022-03-04 (modified 2024-11-23) · logsource: product=windows category=process_creation · 24e3e58a-646b-4b50-adef-02ef935b9fc8
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Author: Tim Rauch, Janantha Marasinghe, Elastic (original idea)
· 2022-11-08 (modified 2023-01-22) · logsource: product=windows category=process_creation · 2d3cdeec-c0db-45b4-aa86-082f7eb75701
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
· 2023-04-27 · logsource: product=windows category=ps_script · 3245cd30-e015-40ff-a31d-5cadd5f377ec
Detects the execution of the hacktool Rubeus using specific command line flags
Author: Milad Cheraghi
· 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
Author: Swachchhanda Shrawan Poudel
· 2024-02-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 34275eb8-fa19-436b-b959-3d9ecd53fa1f
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
Author: Florian Roth (Nextron Systems)
· 2022-04-27 (modified 2024-01-15) · logsource: product=windows category=process_creation · 37c1333a-a0db-48be-b64b-7393b2386e3b
Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-11 (modified 2026-07-28) · logsource: product=windows category=file_access · 407aecb1-e762-4acf-8c7b-d087bcff3bb6
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 416bc4a2-7217-4519-8dc7-c3271817f1d5
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
Author: Pawel Mazur
· 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc
Detect attempt to enable auditing of TTY input
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 547dfc53-ebf6-4afe-8d2e-793d9574975d
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
Author: Andreas Braathen (mnemonic.io)
· 2025-10-19 · logsource: product=windows service=security · 5d6c375a-18ae-4952-b4f6-8b803f6c8555
Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json.
The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.
Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.
Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
hightest
Author: SecurityAura
· 2022-11-16 (modified 2024-06-27) · logsource: product=windows category=file_event · 6e2a900a-ced9-4e4a-a9c2-13e706f9518a
Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 6e78f90f-0043-4a01-ac41-f97681613a66
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 78cc2dd2-7d20-4d32-93ff-057084c38b93
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Author: sam0x90
· 2021-08-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7df1713a-1a5b-4a4b-a071-dc83b144a101
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
Author: Florian Roth (Nextron Systems)
· 2018-12-19 (modified 2023-04-20) · logsource: product=windows category=process_creation · 7ec2c172-dceb-4c10-92c9-87c1881b7e18
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-27 · logsource: product=windows category=process_creation · 8a1b2c3d-4e5f-6789-abcd-ef1234567890
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
Author: frack113, X__Junior (Nextron Systems)
· 2022-04-09 (modified 2024-07-29) · logsource: product=windows category=file_access · 91cb43db-302a-47e3-b3c8-7ede481e27bf
Detects file access requests to browser credential stores by uncommon processes.
Could indicate potential attempt of credential stealing.
Requires heavy baselining before usage
Author: Julia Fomina, oscd.community
· 2020-10-09 (modified 2025-10-31) · logsource: product=windows category=process_creation · 93671f99-04eb-4ab4-a161-70d446a84003
Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 (modified 2022-12-30) · logsource: product=windows category=process_creation · 97dbf6e2-e436-44d8-abee-4261b24d3e41
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows category=file_event · a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-21 · logsource: product=aws service=cloudtrail · a840e606-7c8c-4684-9bc1-eb6b6155127f
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2019-10-22 (modified 2022-11-10) · logsource: product=windows category=process_creation · b17ea6f7-6e90-447e-a799-e6c0a493d6ce
Shadow Copies creation using operating systems utilities, possible credential access
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-23 (modified 2023-02-02) · logsource: product=windows category=process_creation · baef1ec6-2ca9-47a3-97cc-4cf2bda10b77
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Author: sawwinnnaung
· 2020-05-07 (modified 2023-10-11) · logsource: product=azure service=activitylogs · c1182e02-49a3-481c-b3de-0fadc4091488
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Author: X__Junior (Nextron Systems)
· 2024-07-29 · logsource: product=windows category=file_access · c5f37810-a85f-4186-81e9-33f23abb4141
Detects file access requests to chromium based browser sensitive files by uncommon processes.
Could indicate potential attempt of stealing sensitive information.
Author: Florian Roth (Nextron Systems), Samir Bousseaden
· 2021-11-27 (modified 2023-03-02) · logsource: product=windows category=process_creation · c8da0dfd-4ed0-4b68-962d-13c9c884384e
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Author: Max Altgelt (Nextron Systems)
· 2021-09-21 (modified 2022-12-25) · logsource: product=windows category=ps_script · cd185561-4760-45d6-a63e-a51325112cae
Detects usage of a PowerShell command to dump the live memory of a Windows machine
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · e7d79a1b-25ed-4956-bd56-bd344fa8fd06
Detects instances where a MySQL service on an OpenCanary node has had a login attempt.
Author: Swachchhanda Shrawan Poudel
· 2024-02-12 · logsource: product=windows category=process_creation · e83e8899-c9b2-483b-b355-5decc942b959
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Author: X__Junior (Nextron Systems)
· 2024-07-29 · logsource: product=windows category=file_access · f41b0311-44f9-44f0-816d-dd45e39d4bc8
Detects file access requests to crypto currency files by uncommon processes.
Could indicate potential attempt of crypto currency wallet stealing.