ĪPT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. ĪPT1 has been known to use credential dumping using Mimikatz. CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.The following SSPs can be used to access credentials: An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full.These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.Īs well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.įor example, on the target host use procdump:īuilt-in Windows tools such as comsvcs.dll can also be used: After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
0 Comments
Leave a Reply. |