ATT&CK coverage › Technique

OS Credential Dumping: LSA Secrets `T1003.004`

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.

Events covered

12 catalog events are tagged with this technique by at least one rule.

Provider	Event ID	Title
Sysmon	1	Process creation
Sysmon	11	FileCreate
Sysmon	13	RegistryEvent (Value Set)
Sysmon	17	PipeEvent (Pipe Created)
Sysmon	18	PipeEvent (Pipe Connected)
Security-Auditing	4662	An operation was performed on an object.
Security-Auditing	4672	Special privileges assigned to new logon.
Security-Auditing	4688	A new process has been created.
Security-Auditing	4692	Backup of data protection master key was attempted.
Security-Auditing	4697	A service was installed in the system.
Security-Auditing	5145	A network share object was checked to see whether client can be granted desired access.
Service-Control-Manager	7045	A service was installed in the system.

Authoring guide

Patterns shared across the 11 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (17 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`RelativeTargetName`	2	`eq` 1, `match` 1	`winreg`, `SYSTEM32\`, `.tmp`
`CommandLine`	2	`match` 2	`save` , `hkey_local_machine`, `ˢave` , `::printnightmare`, `::mstsc`
`EventType`	1	`eq` 1	`logged-in-special`
`PrivilegeList`	1	`eq` 1	`SeBackupPrivilege`
`TargetFilename`	1	`ends_with` 1, `match` 1	`\pwdump.exe`, `\kirbi`, `\wce_krbtkts`
`ServiceFileName`	1	`match` 1	`servpw`, `dumpsvc`, `gsecdump`
`ImagePath`	1	`match` 1	`servpw`, `dumpsvc`, `gsecdump`
`Provider_Name`	1	`eq` 1	`Service Control Manager`
`ObjectName`	1	`match` 1	`BCKUPKEY`
`AccessMask`	1	`eq` 1	`0x2`
`ObjectType`	1	`eq` 1	`SecretObject`
`Image`	1	`ends_with` 1	`\reg.exe`
`OriginalFileName`	1	`eq` 1	`reg.exe`
`PipeName`	1	`match` 1	`\cachedump`, `\lsadump`, `\wceservicepipe`
`ShareName`	1	`eq` 1	`\\\\\*\\ADMIN$`

Top indicator values (99 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

Field	Kind	Value	Rules (here)
`RelativeTargetName`	`eq`	`winreg`	1
`PrivilegeList`	`eq`	`SeBackupPrivilege`	1
`EventType`	`eq`	`logged-in-special`	1
`TargetFilename`	`ends_with`	`\NTDS.out`	1
`TargetFilename`	`ends_with`	`\DumpSvc.exe`	1
`TargetFilename`	`ends_with`	`\wceaux.dll`	1
`TargetFilename`	`ends_with`	`\servpw64.exe`	1
`TargetFilename`	`ends_with`	`\cachedump64.exe`	1
`TargetFilename`	`ends_with`	`\servpw.exe`	1
`TargetFilename`	`ends_with`	`\lsremora.dll`	1
`TargetFilename`	`ends_with`	`\pstgdump.exe`	1
`TargetFilename`	`ends_with`	`\pwdump.exe`	1
`TargetFilename`	`ends_with`	`\DumpExt.dll`	1
`TargetFilename`	`match`	`\fgdump-log`	1
`TargetFilename`	`ends_with`	`\SECURITY.out`	1
`TargetFilename`	`ends_with`	`\SAM.out`	1
`TargetFilename`	`ends_with`	`\lsremora64.dll`	1
`TargetFilename`	`ends_with`	`\cachedump.exe`	1
`TargetFilename`	`ends_with`	`\SYSTEM.out`	1
`TargetFilename`	`ends_with`	`\Dumpy.exe`	1

Common exclusions (1 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

Field	Kind	Value	Rules excluding
`PrivilegeList`	`eq`	`SeDebugPrivilege`	1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 9 rules

Cred Dump Tools Dropped Files severity high, 1 event, 27 indicators, 0 exclusions
Credential Dumping Tools Service Execution - Security severity high, 1 event, 7 indicators, 0 exclusions
Credential Dumping Tools Service Execution - System severity high, 1 event, 8 indicators, 0 exclusions
DPAPI Domain Backup Key Extraction severity high, 1 event, 3 indicators, 0 exclusions
DPAPI Domain Master Key Backup Attempt severity medium, 1 event, 0 indicators, 0 exclusions
Dumping of Sensitive Hives Via Reg.EXE severity high, 1 event, 20 indicators, 0 exclusions
HackTool - Credential Dumping Tools Named Pipe Created severity critical, 2 events, 3 indicators, 0 exclusions
HackTool - Mimikatz Execution severity high, 2 events, 23 indicators, 0 exclusions
Possible Impacket SecretDump Remote Activity severity high, 1 event, 3 indicators, 0 exclusions

Elastic 1 rule

Suspicious Remote Registry Access via SeBackupPrivilege 2 events, 3 indicators, 1 exclusion

Splunk 1 rule

Windows LSA Secrets NoLMhash Registry 1 event, 2 indicators, 0 exclusions

OS Credential Dumping: LSA Secrets T1003.004