Full Report
MITRE ATT&CK Walkthrough: T1003.001 (OS Credential Dumping: LSASS Memory)
Analysis Summary
# Tool/Technique: T1003.001 - OS Credential Dumping: LSASS Memory
## Overview
This technique involves attempting to access and duplicate the memory contents of the Local Security Authority Subsystem Service (LSASS) process (`lsass.exe`). LSASS is a critical Windows process responsible for enforcing security policy, verifying users logging on, and handling password changes. It is a high-value target because it stores sensitive credential material—such as Kerberos tickets, NTLM hashes, and cleartext passwords—for all active user sessions in its memory space.
## Technical Details
- **Type:** Technique (Abusing Living-off-the-Land Binaries/LOLBins)
- **Platform:** Windows
- **Capabilities:** Memory dumping, credential harvesting, bypassing signature-based detection.
- **First Seen:** Historically used by Mimikatz; modern variants (Comsvcs.dll) have been prevalent for several years.
## MITRE ATT&CK Mapping
- **TA0006 - Credential Access**
- **T1003 - OS Credential Dumping**
- **T1003.001 - LSASS Memory**
## Functionality
### Core Capabilities
- **Direct Memory Access:** Attackers use API calls like `NtReadVirtualMemory` or `MiniDumpWriteDump` to read the memory space of `lsass.exe`.
- **LOLBin Abuse:** Utilizing `comsvcs.dll` via `rundll32.exe` to perform a "MiniDump" of LSASS. Because both files are Microsoft-signed binaries, they often bypass basic application whitelisting and antivirus signatures.
- **Silent Process Exit Abusal:** Manipulating the **Image File Execution Options (IFEO)** registry key to trigger `WerFault.exe` (Windows Error Reporting) to dump LSASS memory automatically upon a specific trigger.
### Advanced Features
- **Stealth via Built-in Tools:** By avoiding custom malware like Mimikatz, attackers minimize the forensic footprint and signature alerts.
- **Remote Extraction:** Once the `.dmp` file is created locally, it can be exfiltrated to an attacker-controlled machine to be parsed offline, avoiding further noise on the target host.
## Indicators of Compromise
- **File Hashes:** N/A (Uses legitimate system files `comsvcs.dll` and `rundll32.exe`).
- **File Names:** `lsass.dmp`, `dump.bin`, or any `.dmp` file created in suspicious directories.
- **Registry Keys:** `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe`
- **Network Indicators:** N/A (Primarily a local host-based technique).
- **Behavioral Indicators:**
- `rundll32.exe` calling the `MiniDump` export of `comsvcs.dll`.
- Command line: `rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump [LSASS_PID] [Path_to_Dump] full`.
- Process chains where `PowerShell.exe` or `cmd.exe` spawns a process that requests `PROCESS_QUERY_INFORMATION` and `PROCESS_VM_READ` access to `lsass.exe`.
## Associated Threat Actors
- **Ransomware Crews** (Various)
- **Nation-State Operators** (APTs)
- General post-exploitation activities following initial access.
## Detection Methods
- **Behavioral Detection:** Monitor for any process requesting `PROCESS_VM_READ` or `NtReadVirtualMemory` handles specifically for the `lsass.exe` process.
- **Command Line Monitoring:** Alert on the string `comsvcs.dll, MiniDump` appearing in process execution logs, especially when targeted at LSASS.
- **File System Monitoring:** Watch for the creation of `.dmp` files in `C:\Windows\Temp\`, `C:\Users\Public\`, or user profile directories by unexpected processes.
- **Crossproc Events:** Correlate cross-process events where a non-system diagnostic tool attempts to touch the LSASS memory space.
## Mitigation Strategies
- **Windows Defender Credential Guard:** The primary defense; it isolates LSASS secrets in a virtualized container (VBS) that prevents direct memory reads even by administrative users.
- **Attack Surface Reduction (ASR):** Enable rules that "Block credential stealing from the Windows local security authority subsystem."
- **Privileged Access Management:** Restrict administrative privileges to reduce the number of accounts capable of performing memory dumps.
- **LSA Protection:** Enable `RunAsPPL` to ensure the LSASS process is started as a protected process.
## Related Tools/Techniques
- **Mimikatz:** The most famous tool for LSASS dumping.
- **Procdump:** A legitimate Sysinternals tool often abused for the same purpose.
- **T1003.002:** Security Account Manager (SAM) dumping.
- **T1003.004:** LSA Secrets dumping.