LSASS Credential-Dumping Methods, Tools, and Defenses
Summary
A walkthrough of local and remote LSASS credential dumping covers tools, dump parsing, and detection. It also outlines defenses including Credential Guard, LSASS Protected Process Light, ASR rules, and network monitoring.
Key points
- LSASS memory may contain NT hashes, Kerberos tickets, cleartext passwords, DPAPI keys, and Kerberos session keys.
- Remote dumping tools discussed include lsassy, NetExec modules, nanodump, and Impacket secretsdump.
- Local dump methods include Process Explorer, Task Manager, ProcDump, and comsvcs.dll via rundll32.
- The article describes using pypykatz to parse LSASS dumps and recover credential material.
- Suggested defenses include Credential Guard, LSASS Protected Process Light, and Attack Surface Reduction rules.
- Network detection examples include monitoring DRSUAPI/DCSync activity, unusual SMB admin-share access, unexpected RemoteRegistry starts, and large transfers from domain controllers.
Article Details
- Topic
- LSASS credential-dumping techniques, tools, detection, and mitigations
MITRE ATT&CK
T1003.001 · LSASS MemoryThe article describes dumping LSASS memory to recover credentials, including hashes, passwords, and Kerberos material.T1003.006 · DCSyncThe article describes DCSync using DRSUAPI to extract domain credentials.T1021.002 · SMB/Windows Admin SharesThe article describes using SMB administrative shares to transfer a dumping tool to a target and retrieve a dump.T1550.002 · Pass the HashRecovered NT hashes may be used for Pass-the-Hash authentication.T1550.003 · Pass the TicketRecovered Kerberos tickets may be used for Pass-the-Ticket attacks.
Vendors
Products
Credential GuardIt also covers parsing dumps with pypykatz, network-level detection for DRSUAPI/DCSync and anomalous SMB activity, and mitigations such as Credential Guard and LSASS Protected Process Light.Microsoft WindowsThe Windows Local Security Authority Subsystem Service (LSASS) is a prime target because it holds authentication data for all interactive sessions on a machine.
Tools
Impacket#lsassylsassyRemote dumping tools include lsassy, NetExec (nxc) modules, nanodump, and impacket-secretsdump, often leveraging SMB, RPC, or DRSUAPI.MimikatzTransfer the dump file to Kali and parse with pypykatz or mimikatz.nanodump#lsassyNetExecRemote dumping tools include lsassy, NetExec (nxc) modules, nanodump, and impacket-secretsdump, often leveraging SMB, RPC, or DRSUAPI.ProcDumpLocal dumping methods use Process Explorer, Task Manager, comsvcs.dll via rundll32, and ProcDump to create LSASS memory dumps.Process ExplorerLocal dumping methods use Process Explorer, Task Manager, comsvcs.dll via rundll32, and ProcDump to create LSASS memory dumps.pypykatzIt also covers parsing dumps with pypykatz, network-level detection for DRSUAPI/DCSync and anomalous SMB activity, and mitigations such as Credential Guard and LSASS Protected Process Light.RubeusKerberos Session Keys — Saved to disk as .ccache files for use with tools like Rubeus or ticket-converter.ticket-converterKerberos Session Keys — Saved to disk as .ccache files for use with tools like Rubeus or ticket-converter.