LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1003.004: LSA Secrets

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.[1][2][3] LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.[4]

Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.[4]

EnterpriseT1003.004Sub-techniqueObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

LSA Secrets is a Windows credential-access behavior where an adversary who already has SYSTEM-level access may try to retrieve credential material stored under the Local Security Authority, including possible service account credentials. For leaders, the business issue is not the registry path itself; it is that one compromised Windows host can become a source of credentials that may enable broader access, especially where service accounts or privileged credentials are poorly governed.

Executive priority

Treat this as a validation point for privileged access and Windows credential hygiene. Ask whether service account credentials are stored or reusable in ways that make a single host compromise material to business continuity, incident scope, and audit evidence. Priority should go to systems where SYSTEM compromise would expose high-value credentials, critical operations, or administrative tiers referenced by Microsoft privileged access guidance.

Technical view

This is a Windows credential-access sub-technique of OS Credential Dumping. ATT&CK notes that LSA secrets reside at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets and may also be dumped from memory. Reg is cited as a registry extraction option, and Mimikatz is cited for memory extraction; related software also includes gsecdump, LaZagne, Impacket, CrackMapExec, AADInternals, Pupy, CosmicDuke, and IceApple. Because the official detection field is not provided, SOC teams should use DET0437 as relationship context and validate local visibility for registry access, memory extraction behavior, and execution of known credential-dumping tooling rather than assuming coverage exists.

Likely telemetry

  • Windows process creation and command-line telemetry for credential-dumping tools or unusual registry access utilities
  • Registry access or auditing around HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets
  • Security events showing privileged or SYSTEM-level execution context
  • Endpoint telemetry for memory access or dumping activity involving Local Security Authority-related processes
  • File creation telemetry for dumped registry hives, memory dumps, or credential output artifacts

Detection direction

  • Confirm whether DET0437 or equivalent analytics are deployed and mapped specifically to both registry-based and memory-based LSA secret extraction.
  • Tune detections around access to HKLM\SECURITY\Policy\Secrets, but account for legitimate administrative, backup, security, or forensic tools that may touch protected registry areas.
  • Correlate suspicious registry or memory access with SYSTEM-level process execution and known credential-dumping software relationships supplied by ATT&CK.
  • Do not rely only on tool names such as Mimikatz; ATT&CK shows multiple tools can use this behavior, and the technique can be performed through registry or memory paths.
  • Use relationship context to prioritize higher scrutiny where threat intelligence, red-team testing, or incident evidence involves OS Credential Dumping or the listed software families.

Mitigation priorities

  • Prioritize privileged account management: reduce unnecessary local administrative/SYSTEM exposure, apply least privilege, and monitor privileged account use.
  • Review service account design and credential storage practices so credentials exposed through LSA secrets have limited scope and cannot easily support broad lateral access.
  • Apply strong password policies, especially for service and privileged accounts, to reduce credential reuse and downstream impact if secrets are obtained.
  • Use user training as a supporting control for reducing initial compromise paths that may precede SYSTEM access, while recognizing it does not directly prevent LSA secret dumping once SYSTEM access exists.
  • Maintain incident response playbooks for suspected credential dumping that include credential rotation decisions, service account impact review, and evidence preservation.
Additional notes and limits

ATT&CK provides no official detection narrative for this sub-technique, but it does provide a detection-strategy relationship named Detection of LSA Secrets Dumping via Registry and Memory Extraction. The object is Windows-specific, credential-access focused, and explicitly tied to OS Credential Dumping. Multiple named groups and software entries are related, which supports prioritization for threat-informed defense, but those relationships should not be read as evidence of current activity in any specific environment.

This take is limited to the supplied ATT&CK object fields, references, and relationships. It does not establish active exploitation, customer exposure, or guaranteed detectability. Local conclusions require endpoint logging configuration, privileged account inventory, service account review, and validation of registry and memory access telemetry.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

LSA Secrets

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.[1][2][3] LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.[4]

Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.[4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1003OS Credential DumpingThis object subtechnique of OS Credential Dumping.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

GroupEnterprise

G0027: Threat Group-3390

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]

GroupEnterprise

G0049: OilRig

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]

GroupEnterprise

G0077: Leafminer

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. [1]

GroupEnterprise

G0064: APT33

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]

GroupEnterprise

G0016: APT29

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]

GroupEnterprise

G0045: menuPass

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]

GroupEnterprise

G0035: Dragonfly

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]

GroupEnterprise

G1003: Ember Bear

Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).[1] Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.[2] Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.[3][4][1] There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.[2][5]

GroupEnterprise

G0004: Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.[1][2][3][4]

MalwareEnterprise

S1022: IceApple

IceApple is a modular Internet Information Services (IIS) post-exploitation framework, that has been used since at least 2021 against the technology, academic, and government sectors.[1]

Windows
ToolEnterprise

S0008: gsecdump

gsecdump is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. [1]

Windows
ToolEnterprise

S0349: LaZagne

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.[1]

LinuxmacOSWindows
ToolEnterprise

S0488: CrackMapExec

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks.[1]

Windows
ToolEnterprise

S0677: AADInternals

AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.[1][2]

WindowsOffice SuiteIdentity Provider
ToolEnterprise

S0357: Impacket

Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.[1]

LinuxmacOSWindows
ToolEnterprise

S0192: Pupy

Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. [1] It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). [1] Pupy is publicly available on GitHub. [1]

LinuxWindowsmacOS
ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
Relationship explorer

All related ATT&CK context

uses · GroupG0069: MuddyWaterEnterpriseuses · MalwareS1022: IceAppleEnterpriseuses · MalwareS0050: CosmicDukeEnterpriseuses · ToolS0008: gsecdumpEnterpriseuses · ToolS0349: LaZagneEnterpriseuses · GroupG0027: Threat Group-3390Enterprisesubtechnique of · TechniqueT1003: OS Credential DumpingEnterpriseuses · GroupG0049: OilRigEnterpriseuses · ToolS0488: CrackMapExecEnterprisemitigates · MitigationM1027: Password PoliciesEnterpriseuses · GroupG0077: LeafminerEnterpriseuses · GroupG0064: APT33Enterprisemitigates · MitigationM1026: Privileged Account ManagementEnterpriseuses · GroupG0016: APT29Enterpriseuses · GroupG0045: menuPassEnterpriseuses · GroupG0035: DragonflyEnterpriseuses · ToolS0677: AADInternalsEnterpriseuses · ToolS0357: ImpacketEnterprisemitigates · MitigationM1017: User TrainingEnterpriseuses · ToolS0192: PupyEnterpriseuses · GroupG1003: Ember BearEnterprisedetects · Detection StrategyDET0437: Detection of LSA Secrets Dumping via Registry and Memory ExtractionEnterpriseuses · GroupG0004: Ke3changEnterpriseuses · ToolS0002: MimikatzEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1027: Password Policies

Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures:

Windows Systems:

- Use Group Policy Management Console (GPMC) to configure: - Minimum password length (e.g., 12+ characters). - Password complexity requirements. - Password history (e.g., disallow last 24 passwords). - Account lockout duration and thresholds.

Linux Systems:

- Configure Pluggable Authentication Modules (PAM): - Use `pam_pwquality` to enforce complexity and length requirements. - Implement `pam_tally2` or `pam_faillock` for account lockouts. - Use `pwunconv` to disable password reuse.

Password Managers:

- Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.

Password Blacklisting:

- Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.

Regular Auditing:

- Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.

*Tools for Implementation*

Windows:

- Group Policy Management Console (GPMC): Enforce password policies. - Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.

Linux/macOS:

- PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules. - Lynis: Audit password policies and system configurations.

Cross-Platform:

- Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords. - Have I Been Pwned API: Prevent the use of breached passwords. - NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.

MitigationEnterprise

M1026: Privileged Account Management

Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures:

Account Permissions and Roles:

- Implement RBAC and least privilege principles to allocate permissions securely. - Use tools like Active Directory Group Policies to enforce access restrictions.

Credential Security:

- Deploy password vaulting tools like CyberArk, HashiCorp Vault, or KeePass for secure storage and rotation of credentials. - Enforce password policies for complexity, uniqueness, and expiration using tools like Microsoft Group Policy Objects (GPO).

Multi-Factor Authentication (MFA):

- Enforce MFA for all privileged accounts using Duo Security, Okta, or Microsoft Azure AD MFA.

Privileged Access Management (PAM):

- Use PAM solutions like CyberArk, BeyondTrust, or Thycotic to manage, monitor, and audit privileged access.

Auditing and Monitoring:

- Integrate activity monitoring into your SIEM (e.g., Splunk or QRadar) to detect and alert on anomalous privileged account usage.

Just-In-Time Access:

- Deploy JIT solutions like Azure Privileged Identity Management (PIM) or configure ephemeral roles in AWS and GCP to grant time-limited elevated permissions.

*Tools for Implementation*

Privileged Access Management (PAM):

- CyberArk, BeyondTrust, Thycotic, HashiCorp Vault.

Credential Management:

- Microsoft LAPS (Local Admin Password Solution), Password Safe, HashiCorp Vault, KeePass.

Multi-Factor Authentication:

- Duo Security, Okta, Microsoft Azure MFA, Google Authenticator.

Linux Privilege Management:

- sudo configuration, SELinux, AppArmor.

Just-In-Time Access:

- Azure Privileged Identity Management (PIM), AWS IAM Roles with session constraints, GCP Identity-Aware Proxy.

MitigationEnterprise

M1017: User Training

User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures:

Create Comprehensive Training Programs:

- Design training modules tailored to the organization's risk profile, covering topics such as phishing, password management, and incident reporting. - Provide role-specific training for high-risk employees, such as helpdesk staff or executives.

Use Simulated Exercises:

- Conduct phishing simulations to measure user susceptibility and provide targeted follow-up training. - Run social engineering drills to evaluate employee responses and reinforce protocols.

Leverage Gamification and Engagement:

- Introduce interactive learning methods such as quizzes, gamified challenges, and rewards for successful detection and reporting of threats.

Incorporate Security Policies into Onboarding:

- Include cybersecurity training as part of the onboarding process for new employees. - Provide easy-to-understand materials outlining acceptable use policies and reporting procedures.

Regular Refresher Courses:

- Update training materials to include emerging threats and techniques used by adversaries. - Ensure all employees complete periodic refresher courses to stay informed.

Emphasize Real-World Scenarios:

- Use case studies of recent attacks to demonstrate the consequences of successful phishing or social engineering. - Discuss how specific employee actions can prevent or mitigate such attacks.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
0961c2ef8bee1e8f...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle0961c2ef8bee…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Passcape LSA Secrets

    Passcape. (n.d.). Windows LSA secrets. Retrieved February 21, 2020.

    Open source URL
  2. [2]
    Microsoft AD Admin Tier Model

    Microsoft. (2019, February 14). Active Directory administrative tier model. Retrieved February 21, 2020.

    Open source URL
  3. [3]
    Tilbury Windows Credentials

    Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack, Mitigation, Defense. Retrieved February 21, 2020.

    Open source URL
  4. [4]
    ired Dumping LSA Secrets

    Mantvydas Baranauskas. (2019, November 16). Dumping LSA Secrets. Retrieved February 21, 2020.

    Open source URL
  5. [5]
    Unit 42 MuddyWater Nov 2017

    Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018.

    Open source URL
  6. [6]
    Symantec MuddyWater Dec 2018

    Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.

    Open source URL
  7. [7]
    CrowdStrike IceApple May 2022

    CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022.

    Open source URL
  8. [8]
    F-Secure The Dukes

    F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.

    Open source URL
  9. [9]
    TrueSec Gsecdump

    TrueSec. (n.d.). gsecdump v2.0b5. Retrieved November 17, 2024.

    Open source URL
  10. [10]
    GitHub LaZagne Dec 2018

    Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018.

    Open source URL
  11. [11]
    Dell TG-3390

    Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.

    Open source URL
  12. [12]
    SecureWorks BRONZE UNION June 2017

    Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.

    Open source URL
  13. [13]
    Unit42 OilRig Playbook 2023

    Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023.

    Open source URL
  14. [14]
    FireEye APT34 Webinar Dec 2017

    Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.

    Open source URL
  15. [15]
    FireEye APT35 2018

    Mandiant. (2018). Mandiant M-Trends 2018. Retrieved November 17, 2024.

    Open source URL
  16. [16]
    FireEye APT34 July 2019

    Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019.

    Open source URL
  17. [17]
    CME Github September 2018

    byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.

    Open source URL
  18. [18]
    Symantec Leafminer July 2018

    Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.

    Open source URL
  19. [19]
    Symantec Elfin Mar 2019

    Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.

    Open source URL
  20. [20]
    FireEye APT33 Guardrail

    Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.

    Open source URL
  21. [21]
    Mandiant APT29 Eye Spy Email Nov 22

    Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.

    Open source URL
  22. [22]
    PWC Cloud Hopper Technical Annex April 2017

    PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.

    Open source URL
  23. [23]
    Github AD-Pentest-Script

    Twi1ight. (2015, July 11). AD-Pentest-Script - wmiexec.vbs. Retrieved June 29, 2017.

    Open source URL
  24. [24]
    US-CERT TA18-074A

    US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.

    Open source URL
  25. [25]
    Core Security Impacket

    Core Security. (n.d.). Impacket. Retrieved November 2, 2017.

    Open source URL
  26. [26]
    AADInternals Documentation

    Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022.

    Open source URL
  27. [27]
    Impacket Tools

    SecureAuth. (n.d.). Retrieved January 15, 2019.

    Open source URL
  28. [28]
    GitHub Pupy

    Nicolas Verdier. (n.d.). Retrieved January 29, 2018.

    Open source URL
  29. [29]
    CISA GRU29155 2024

    US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.

    Open source URL
  30. [30]
    Mandiant Operation Ke3chang November 2014

    Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.

    Open source URL
  31. [31]
    NCC Group APT15 Alive and Strong

    Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.

    Open source URL
  32. [32]
    Deply Mimikatz

    Deply, B. (n.d.). Mimikatz. Retrieved September 29, 2015.

    Open source URL
  33. [33]
    GitHub Mimikatz lsadump Module

    Deply, B., Le Toux, V. (2016, June 5). module ~ lsadump. Retrieved August 7, 2017.

    Open source URL
  34. [34]
    Directory Services Internals DPAPI Backup Keys Oct 2015

    Grafnetter, M. (2015, October 26). Retrieving DPAPI Backup Keys from Active Directory. Retrieved December 19, 2017.

    Open source URL
  35. [35]
    NCSC Joint Report Public Tools

    The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

    Open source URL
  36. [36]
    Microsoft AD Admin Tier Model

    Microsoft. (2019, February 14). Active Directory administrative tier model. Retrieved February 21, 2020.

    Open source URL
  37. [37]
    Microsoft AD Admin Tier Model

    Microsoft. (2019, February 14). Active Directory administrative tier model. Retrieved February 21, 2020.

    Open source URL
  38. [38]
    Passcape LSA Secrets

    Passcape. (n.d.). Windows LSA secrets. Retrieved February 21, 2020.

    Open source URL
  39. [39]
    Passcape LSA Secrets

    Passcape. (n.d.). Windows LSA secrets. Retrieved February 21, 2020.

    Open source URL
  40. [40]
    Powersploit

    PowerSploit. (n.d.). Retrieved December 4, 2014.

    Open source URL
  41. [41]
    Powersploit

    PowerSploit. (n.d.). Retrieved December 4, 2014.

    Open source URL
  42. [42]
    Powersploit

    PowerSploit. (n.d.). Retrieved December 4, 2014.

    Open source URL
  43. [43]
    Tilbury Windows Credentials

    Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack, Mitigation, Defense. Retrieved February 21, 2020.

    Open source URL
  44. [44]
    Tilbury Windows Credentials

    Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack, Mitigation, Defense. Retrieved February 21, 2020.

    Open source URL
  45. [45]
    ired Dumping LSA Secrets

    Mantvydas Baranauskas. (2019, November 16). Dumping LSA Secrets. Retrieved February 21, 2020.

    Open source URL
  46. [46]
    ired Dumping LSA Secrets

    Mantvydas Baranauskas. (2019, November 16). Dumping LSA Secrets. Retrieved February 21, 2020.

    Open source URL
  47. [47]
    mitre-attackT1003.004
    Open source URL
  48. [48]
    mitre-attackT1003.004
    Open source URL
  49. [49]
    mitre-attackT1003.004
    Open source URL
  50. [50]
    Symantec MuddyWater Dec 2018

    Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.

    Open source URL
  51. [51]
    Unit 42 MuddyWater Nov 2017

    Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018.

    Open source URL
  52. [52]
    CrowdStrike IceApple May 2022

    CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022.

    Open source URL
  53. [53]
    F-Secure The Dukes

    F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.

    Open source URL
  54. [54]
    TrueSec Gsecdump

    TrueSec. (n.d.). gsecdump v2.0b5. Retrieved November 17, 2024.

    Open source URL
  55. [55]
    GitHub LaZagne Dec 2018

    Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018.

    Open source URL
  56. [56]
    Dell TG-3390

    Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.

    Open source URL
  57. [57]
    SecureWorks BRONZE UNION June 2017

    Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.

    Open source URL
  58. [58]
    FireEye APT34 July 2019

    Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019.

    Open source URL
  59. [59]
    FireEye APT34 Webinar Dec 2017

    Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.

    Open source URL
  60. [60]
    FireEye APT35 2018

    Mandiant. (2018). Mandiant M-Trends 2018. Retrieved November 17, 2024.

    Open source URL
  61. [61]
    Unit42 OilRig Playbook 2023

    Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023.

    Open source URL
  62. [62]
    CME Github September 2018

    byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.

    Open source URL
  63. [63]
    Symantec Leafminer July 2018

    Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.

    Open source URL
  64. [64]
    FireEye APT33 Guardrail

    Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.

    Open source URL
  65. [65]
    Symantec Elfin Mar 2019

    Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.

    Open source URL
  66. [66]
    Tilbury Windows Credentials

    Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack, Mitigation, Defense. Retrieved February 21, 2020.

    Open source URL
  67. [67]
    Tilbury Windows Credentials

    Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack, Mitigation, Defense. Retrieved February 21, 2020.

    Open source URL
  68. [68]
    Mandiant APT29 Eye Spy Email Nov 22

    Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.

    Open source URL
  69. [69]
    Github AD-Pentest-Script

    Twi1ight. (2015, July 11). AD-Pentest-Script - wmiexec.vbs. Retrieved June 29, 2017.

    Open source URL
  70. [70]
    PWC Cloud Hopper Technical Annex April 2017

    PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.

    Open source URL
  71. [71]
    Core Security Impacket

    Core Security. (n.d.). Impacket. Retrieved November 2, 2017.

    Open source URL
  72. [72]
    US-CERT TA18-074A

    US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.

    Open source URL
  73. [73]
    AADInternals Documentation

    Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use