T1003.004: LSA 机密
摘要
拥有主机 SYSTEM 访问权限的攻击者可能尝试访问本地安全机构（LSA）机密，其中可能包含各种不同的凭据材料，例如服务账户的凭据。(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA 机密存储在注册表中的 <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>。LSA 机密也可以从内存中转储。(Citation: ired Dumping LSA Secrets) 可使用 [Reg](https://attack.mitre.org/software/S0075) 从注册表中提取。可使用 [Mimikatz](https://attack.mitre.org/software/S0002) 从内存中提取机密。(Citation: ired Dumping LSA Secrets)
来源归属
来源：MITRE ATT&CK · 置信度：high
平台
- Windows
战术
凭据访问
参考来源
- https://attack.mitre.org/techniques/T1003/004
- https://www.first.org/resources/papers/conf2017/Windows-Credentials-Attacks-and-Mitigation-Techniques.pdf
- https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets
- https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material?redirectedfrom=MSDN
- https://www.passcape.com/index.php?section=docsys&cmd=details&id=23
- https://github.com/mattifestation/PowerSploit