T1003.004 LSA Secrets

Technique

T1003.004

Tactics

Credential Access

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

12

Elastic, Splunk

6

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1003/004

MITRE description

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-21 Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge

Detection coverage

SigmaHQ community rules

• Possible Impacket SecretDump Remote Activity - Zeek (core)
• DPAPI Domain Backup Key Extraction (core)
• DPAPI Domain Master Key Backup Attempt (core)
• Possible Impacket SecretDump Remote Activity (core)
• Credential Dumping Tools Service Execution - Security (core)
• Credential Dumping Tools Service Execution - System (core)
• Mimikatz Use (core)
• Cred Dump Tools Dropped Files (core)
• HackTool - Credential Dumping Tools Named Pipe Created (core)
• HackTool - Mimikatz Execution (core)
• PUA - Memory Dump Mount Via MemProcFS (core)
• Dumping of Sensitive Hives Via Reg.EXE (core)

Elastic and Splunk rules

• Credential Acquisition via Registry Hive Dumping (elastic)
• Potential Invoke-Mimikatz PowerShell Script (elastic)
• PowerShell Invoke-NinjaCopy script (elastic)
• Sensitive Registry Hive Access via RegBack (elastic)
• Suspicious Remote Registry Access via SeBackupPrivilege (elastic)
• Windows LSA Secrets NoLMhash Registry (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.