T1003.004 — LSA Secrets

Tactic: Credential Access · Platforms: Windows

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA…

Sub-technique of OS Credential Dumping (T1003).

Sigma detection rules (1)

T1003.004 OS Credential Dumping: LSA Secrets

title: "T1003.004 OS Credential Dumping: LSA Secrets"
id: eba31c49-54a8-49c4-aa30-fb12df722086
description: 'Detection of LSA Secrets Dumping via Registry and Memory Extraction. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TargetObject, ImageLoaded, AccessMask, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1003/004
author: Shahrukh Khan
date: 2026-03-09
license: MIT
tags:
  - attack.credential-access
  - attack.t1003.004

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_reg_secrets:
    Image|endswith: '\reg.exe'
    CommandLine|contains|all:
      - 'save'
      - 'HKLM\SECURITY'

  selection_ps_secrets:
    CommandLine|contains: 'HKLM:\SECURITY\Policy\Secrets'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate backup or registry-migration tooling that exports the SECURITY hive; verify against a known change record before treating as benign.

level: critical

Related sub-techniques

Explore