MITRE ATT&CK - Техника Память процесса LSASS

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

OS Credential Dumping: Память процесса LSASS

Other sub-techniques of OS Credential Dumping (8)

ID	Название
.001	Память процесса LSASS
.002	Диспетчер учетных записей безопасности
.003	Файл ntds.dit
.004	Секреты LSA
.005	Кэшированные доменные учетные данные
.006	DCSync
.007	Файловая система proc
.008	Содержимое файлов /etc/passwd и /etc/shadow

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material. As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system. For example, on the target host use procdump: * procdump -ma lsass.exe lsass_dump Locally, mimikatz can be run using: * sekurlsa::Minidump lsassdump.dmp * sekurlsa::logonPasswords Built-in Windows tools such as comsvcs.dll can also be used: * rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector) Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014) The following SSPs can be used to access credentials: * Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package. * Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection) * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later. * CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)

ID: T1003.001

Относится к технике: T1003

Тактика(-и): Credential Access

Платформы: Windows

Источники данных: Command: Command Execution, Process: OS API Execution, Process: Process Access, Process: Process Creation

Версия: 1.1

Дата создания: 11 Feb 2020

Последнее изменение: 06 Oct 2022

Название	Описание
Примеры процедур
Indrik Spider	Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.(Citation: Symantec WastedLocker June 2020)
	During Operation Wocao, threat actors used ProcDump to dump credentials from memory.(Citation: FoxIT Wocao December 2019)
OilRig	OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit 42 Playbook Dec 2017)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)
Operation Wocao	Operation Wocao has used ProcDump to dump credentials from memory.(Citation: FoxIT Wocao December 2019)
Cleaver	Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.(Citation: Cylance Cleaver)
Leafminer	Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.(Citation: Symantec Leafminer July 2018)
Threat Group-3390	Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)
SILENTTRINITY	SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call.(Citation: GitHub SILENTTRINITY Modules July 2019)
APT1	APT1 has been known to use credential dumping using Mimikatz.(Citation: Mandiant APT1)
Leviathan	Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.(Citation: FireEye APT40 March 2019)
FIN8	FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
LaZagne	LaZagne can perform credential dumping from memory to obtain account and password information.(Citation: GitHub LaZagne Dec 2018)
HAFNIUM	HAFNIUM has used `procdump` to dump the LSASS process memory.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)
Blue Mockingbird	Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.(Citation: RedCanary Mockingbird May 2020)
Lslsass	Lslsass can dump active logon session password hashes from the lsass process.(Citation: Mandiant APT1)
Lizar	Lizar can run Mimikatz to harvest credentials.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021)
Whitefly	Whitefly has used Mimikatz to obtain credentials.(Citation: Symantec Whitefly March 2019)
APT33	APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)
Bad Rabbit	Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.(Citation: ESET Bad Rabbit)
APT32	APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
CozyCar	CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.(Citation: F-Secure CozyDuke)
Impacket	SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.(Citation: Impacket Tools)
GALLIUM	GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)
NotPetya	NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)(Citation: NCSC Joint Report Public Tools)
Pupy	Pupy can execute Lazagne as well as Mimikatz using PowerShell.(Citation: GitHub Pupy)
Cobalt Strike	Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.(Citation: Cobalt Strike Manual 4.3 November 2020)
PoshC2	PoshC2 contains an implementation of Mimikatz to gather credentials from memory.(Citation: GitHub PoshC2)
BRONZE BUTLER	BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.(Citation: Secureworks BRONZE BUTLER Oct 2017)
Windows Credential Editor	Windows Credential Editor can dump credentials.(Citation: Amplia WCE)
Stolen Pencil	Stolen Pencil gathers credentials using Mimikatz and Procdump. (Citation: Netscout Stolen Pencil Dec 2018)
APT39	APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.(Citation: FireEye APT39 Jan 2019)
Magic Hound	Magic Hound has stolen domain credentials by dumping LSASS process memory with comsvcs.dll and from a Microsoft Active Directory Domain Controller using Mimikatz.(Citation: FireEye APT35 2018)(Citation: DFIR Report APT35 ProxyShell March 2022)
Earth Lusca	Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.(Citation: TrendMicro EarthLusca 2022)
PoetRAT	PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.(Citation: Talos PoetRAT April 2020)
Emotet	Emotet has been observed dropping password grabber modules including Mimikatz. (Citation: Trend Micro Emotet Jan 2019)
PLATINUM	PLATINUM has used keyloggers that are also capable of dumping credentials.(Citation: Microsoft PLATINUM April 2016)
Fox Kitten	Fox Kitten has used prodump to dump credentials from LSASS.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
Net Crawler	Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.(Citation: Cylance Cleaver)
Silence	Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.(Citation: Group IB Silence Sept 2018)
Pysa	Pysa can perform OS credential dumping using Mimikatz.(Citation: CERT-FR PYSA April 2020)
Mimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.(Citation: Deply Mimikatz)(Citation: GitHub Mimikatz lsadump Module)(Citation: Directory Services Internals DPAPI Backup Keys Oct 2015)(Citation: NCSC Joint Report Public Tools)
Sandworm Team	Sandworm Team's plainpwd tool is a modified version of Mimikatz and dumps Windows credentials from system memory.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)
MuddyWater	MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)
Lazarus Group	Lazarus Group leveraged Mimikatz to extract Windows Credentials of currently logged-in users and steals passwords stored in browsers.(Citation: Lazarus KillDisk) Lazarus Group has also used a custom version Mimikatz to capture credentials.(Citation: F-Secure Lazarus Cryptocurrency Aug 2020)
Aquatic Panda	Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.(Citation: CrowdStrike AQUATIC PANDA December 2021)
Ke3chang	Ke3chang has dumped credentials, including by using Mimikatz.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)
APT3	APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."(Citation: Symantec Buckeye)
APT41	APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)
Empire	Empire contains an implementation of Mimikatz to gather credentials from memory.(Citation: Github PowerShell Empire)
Daserf	Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.(Citation: Symantec Tick Apr 2016)
FIN6	FIN6 has used Windows Credential Editor for credential dumping.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)
APT28	APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.(Citation: ESET Sednit Part 2)(Citation: DOJ GRU Indictment Jul 2018) They have also dumped the LSASS process memory using the MiniDump function.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)
Olympic Destroyer	Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.(Citation: Talos Olympic Destroyer 2018)
Kimsuky	Kimsuky has gathered credentials using Mimikatz and ProcDump.(Citation: CISA AA20-301A Kimsuky)(Citation: Netscout Stolen Pencil Dec 2018)(Citation: KISA Operation Muzabi)
TEMP.Veles	TEMP.Veles has used Mimikatz and a custom tool, SecHack, to harvest credentials. (Citation: FireEye TRITON 2019)
Okrum	Okrum was seen using MimikatzLite to perform credential dumping.(Citation: ESET Okrum July 2019)
PowerSploit	PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
GreyEnergy	GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.(Citation: ESET GreyEnergy Oct 2018)

Контрмера	Описание
Контрмеры
Operating System Configuration	Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.
Credential Access Protection	Use capabilities to prevent successful credential access by adversaries; including blocking forms of credential dumping.
Privileged Process Integrity	Protect processes with high privileges that can be used to interact with critical system components through use of protected process light, anti-process injection defenses, or other process integrity enforcement measures.
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
User Training	Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
Password Policies	Set and enforce secure password policies for accounts.

Обнаружение

Monitor for unexpected processes interacting with LSASS.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as Mimikatz access LSASS.exe by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective Process Injection to reduce potential indicators of malicious activity. On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process. Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,(Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.