ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Technique: T1003.004×

9 examples

Technique	Used by	Procedure example
T1003.004 LSA Secrets	MalwareCosmicDuke	CosmicDuke collects LSA secrets. F-Secure The Dukes
T1003.004 LSA Secrets	MalwareIceApple	IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\\OldVal`. CrowdStrike IceApple May 2022
T1003.004 LSA Secrets	ToolImpacket	SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information. Impacket Tools
T1003.004 LSA Secrets	ToolAADInternals	AADInternals can dump secrets from the Local Security Authority. AADInternals Documentation
T1003.004 LSA Secrets	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.004 LSA Secrets	Toolgsecdump	gsecdump can dump LSA secrets. TrueSec Gsecdump
T1003.004 LSA Secrets	ToolLaZagne	LaZagne can perform credential dumping from LSA secrets to obtain account and password information. GitHub LaZagne Dec 2018
T1003.004 LSA Secrets	ToolCrackMapExec	CrackMapExec can dump hashed passwords from LSA secrets for the targeted system. CME Github September 2018
T1003.004 LSA Secrets	ToolPupy	Pupy can use Lazagne for harvesting credentials. GitHub Pupy

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.