H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

LSA Secrets

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets . LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets . LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)

23 recorded

Relationships

mitigates
from Password Policies
Mitigation
mitigates
from Privileged Account Management
Mitigation
mitigates
from User Training
Mitigation
subtechnique-of
to OS Credential Dumping
Technique
uses
from AADInternals
Tool
uses
from APT29
Group
uses
from APT33
Group
uses
from CosmicDuke
Malware
uses
from CrackMapExec
Tool
uses
from Dragonfly
Group
uses
from Ember Bear
Group
uses
from gsecdump
Tool
uses
from IceApple
Malware
uses
from Impacket
Tool
uses
from Ke3chang
Group
uses
from LaZagne
Tool
uses
from Leafminer
Group
uses
from menuPass
Group
uses
from Mimikatz
Tool
uses
from MuddyWater
Group
uses
from OilRig
Group
uses
from Pupy
Tool
uses
from Threat Group-3390
Group
6 external

References

mitre-attack
T1003.004
open
Tilbury Windows Credentials
https://www.first.org/resources/papers/conf2017/Windows-Credentials-Attacks-and-Mitigation-Techniques.pdf
open
ired Dumping LSA Secrets
https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets
open
Microsoft AD Admin Tier Model
https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material?redirectedfrom=MSDN
open
Passcape LSA Secrets
https://www.passcape.com/index.php?section=docsys&cmd=details&id=23
open
Powersploit
https://github.com/mattifestation/PowerSploit
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance