T1003.004: LSA Secrets
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.[1][2][3] LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.[4]
Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.[4]
Analyst context for executives and security teams
LSA Secrets is a Windows credential-access behavior where an adversary who already has SYSTEM-level access may try to retrieve credential material stored under the Local Security Authority, including possible service account credentials. For leaders, the business issue is not the registry path itself; it is that one compromised Windows host can become a source of credentials that may enable broader access, especially where service accounts or privileged credentials are poorly governed.
Executive priority
Treat this as a validation point for privileged access and Windows credential hygiene. Ask whether service account credentials are stored or reusable in ways that make a single host compromise material to business continuity, incident scope, and audit evidence. Priority should go to systems where SYSTEM compromise would expose high-value credentials, critical operations, or administrative tiers referenced by Microsoft privileged access guidance.
Technical view
This is a Windows credential-access sub-technique of OS Credential Dumping. ATT&CK notes that LSA secrets reside at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets and may also be dumped from memory. Reg is cited as a registry extraction option, and Mimikatz is cited for memory extraction; related software also includes gsecdump, LaZagne, Impacket, CrackMapExec, AADInternals, Pupy, CosmicDuke, and IceApple. Because the official detection field is not provided, SOC teams should use DET0437 as relationship context and validate local visibility for registry access, memory extraction behavior, and execution of known credential-dumping tooling rather than assuming coverage exists.
Likely telemetry
- Windows process creation and command-line telemetry for credential-dumping tools or unusual registry access utilities
- Registry access or auditing around HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets
- Security events showing privileged or SYSTEM-level execution context
- Endpoint telemetry for memory access or dumping activity involving Local Security Authority-related processes
- File creation telemetry for dumped registry hives, memory dumps, or credential output artifacts
Detection direction
- Confirm whether DET0437 or equivalent analytics are deployed and mapped specifically to both registry-based and memory-based LSA secret extraction.
- Tune detections around access to HKLM\SECURITY\Policy\Secrets, but account for legitimate administrative, backup, security, or forensic tools that may touch protected registry areas.
- Correlate suspicious registry or memory access with SYSTEM-level process execution and known credential-dumping software relationships supplied by ATT&CK.
- Do not rely only on tool names such as Mimikatz; ATT&CK shows multiple tools can use this behavior, and the technique can be performed through registry or memory paths.
- Use relationship context to prioritize higher scrutiny where threat intelligence, red-team testing, or incident evidence involves OS Credential Dumping or the listed software families.
Mitigation priorities
- Prioritize privileged account management: reduce unnecessary local administrative/SYSTEM exposure, apply least privilege, and monitor privileged account use.
- Review service account design and credential storage practices so credentials exposed through LSA secrets have limited scope and cannot easily support broad lateral access.
- Apply strong password policies, especially for service and privileged accounts, to reduce credential reuse and downstream impact if secrets are obtained.
- Use user training as a supporting control for reducing initial compromise paths that may precede SYSTEM access, while recognizing it does not directly prevent LSA secret dumping once SYSTEM access exists.
- Maintain incident response playbooks for suspected credential dumping that include credential rotation decisions, service account impact review, and evidence preservation.
Analyst notes and limits
ATT&CK provides no official detection narrative for this sub-technique, but it does provide a detection-strategy relationship named Detection of LSA Secrets Dumping via Registry and Memory Extraction. The object is Windows-specific, credential-access focused, and explicitly tied to OS Credential Dumping. Multiple named groups and software entries are related, which supports prioritization for threat-informed defense, but those relationships should not be read as evidence of current activity in any specific environment.
This take is limited to the supplied ATT&CK object fields, references, and relationships. It does not establish active exploitation, customer exposure, or guaranteed detectability. Local conclusions require endpoint logging configuration, privileged account inventory, service account review, and validation of registry and memory access telemetry.
LSA Secrets
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.[1][2][3] LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.[4]
Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.[4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1003 | OS Credential Dumping | This object subtechnique of OS Credential Dumping. |
Groups, software, and campaigns
G0069: MuddyWater
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]
G0027: Threat Group-3390
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]
G0049: OilRig
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]
G0077: Leafminer
G0064: APT33
G0016: APT29
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]
G0045: menuPass
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]
menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]
G0035: Dragonfly
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]
G1003: Ember Bear
Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).[1] Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.[2] Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.[3][4][1] There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.[2][5]
G0004: Ke3chang
S1022: IceApple
S0050: CosmicDuke
CosmicDuke is malware that was used by APT29 from 2010 to 2015. [1]
S0008: gsecdump
S0349: LaZagne
S0488: CrackMapExec
CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks.[1]
S0677: AADInternals
AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.[1][2]
S0357: Impacket
S0192: Pupy
Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. [1] It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). [1] Pupy is publicly available on GitHub. [1]
S0002: Mimikatz
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 0961c2ef8bee… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Passcape LSA Secrets
Passcape. (n.d.). Windows LSA secrets. Retrieved February 21, 2020.
Open source URL -
[2]
Microsoft AD Admin Tier Model
Microsoft. (2019, February 14). Active Directory administrative tier model. Retrieved February 21, 2020.
Open source URL -
[3]
Tilbury Windows Credentials
Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack, Mitigation, Defense. Retrieved February 21, 2020.
Open source URL -
[4]
ired Dumping LSA Secrets
Mantvydas Baranauskas. (2019, November 16). Dumping LSA Secrets. Retrieved February 21, 2020.
Open source URL -
[5]
Powersploit
PowerSploit. (n.d.). Retrieved December 4, 2014.
Open source URL -
[6]
mitre-attack T1003.004Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.