aol.pm

LSA Secrets

Subtechnique · ATTACK:enterprise:T1003.004

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1003.004",
  "title": "LSA Secrets",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1003/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
  "external_id": "T1003.004",
  "domain": "enterprise",
  "created": "2020-02-21T16:22:09.493Z",
  "modified": "2025-10-24T17:48:29.945Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Tilbury Windows Credentials",
      "url": "https://www.first.org/resources/papers/conf2017/Windows-Credentials-Attacks-and-Mitigation-Techniques.pdf"
    },
    {
      "source_name": "ired Dumping LSA Secrets",
      "url": "https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets"
    },
    {
      "source_name": "Microsoft AD Admin Tier Model",
      "url": "https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material?redirectedfrom=MSDN"
    },
    {
      "source_name": "Passcape LSA Secrets",
      "url": "https://www.passcape.com/index.php?section=docsys&cmd=details&id=23"
    },
    {
      "source_name": "Powersploit",
      "url": "https://github.com/mattifestation/PowerSploit"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1eb79c3a-2cee-48ff-80b1-a5c3f571a3e8

Unit 42 MuddyWater Nov 2017 · Symantec MuddyWater Dec 2018

ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21fa2533-b082-408b-857c-ad6d85a74238

CrowdStrike IceApple May 2022

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2625dfe6-7c02-4df7-b98f-dbfedb2d104b

F-Secure The Dukes

ATTACK:enterprise:S0008 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d063a40-dbba-458f-897d-2b756a2591b1

TrueSec Gsecdump

ATTACK:enterprise:S0349 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fff9b06-61f5-41f5-8cef-210485eaa8b2

GitHub LaZagne Dec 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36b9f594-9a27-4281-a18e-9a5e7df70ad9

Dell TG-3390 · SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:T1003.004 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--386a591e-3e8e-4f23-8a5c-60abfa831d30

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65b58e05-916b-4840-b0a0-bb7fd8dc3f32

FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · FireEye APT35 2018 · Unit42 OilRig Playbook 2023

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7644ad2b-1ee7-43f4-9b06-9928f6f9eb1a

CME Github September 2018

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--766f4421-06f4-4ce1-9d67-85572dbdbeb1

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ffeeb33-0757-4b74-a4ae-504145bc473f

Symantec Leafminer July 2018

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--990e1dac-f103-47c0-91d8-a5238ffc6b99

Symantec Elfin Mar 2019 · FireEye APT33 Guardrail

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bce3518d-52d4-4dc3-9de0-4d801048220d

Tilbury Windows Credentials

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd9a6be1-903f-4a7b-a143-8c8d1da6cabc

Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c69ee5f4-161a-4d2b-bad4-cc7929596bd3

PWC Cloud Hopper Technical Annex April 2017 · Github AD-Pentest-Script

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd849a7c-f63a-4157-b4c9-9385115da08a

Core Security Impacket · US-CERT TA18-074A

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d101870c-304e-4597-a292-7d5e8c870f95

AADInternals Documentation

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de1d9450-317d-42e1-af71-8f531408e5c6

Impacket Tools

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e643eb2e-c309-48dc-b105-ffedb4a61247

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8a51a09-79b4-44d8-8f25-eb8c7c230da5

GitHub Pupy

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e95fb3b3-a522-4e54-8840-e5e746cedd02

AI-Mexico-Govt-Breach

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--efee6215-08f7-40d2-a495-e9e3d55bd822

CISA GRU29155 2024

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3d30d20-ee51-4976-8611-5667df771567

Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and Strong

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5e29f3a-99b1-4c45-952b-c238f72435ab

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.