1200KM / detection
T1003.004 LSA Secrets — Detection Rules
Detection workspace for T1003.004 LSA Secrets: 12 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Possible Impacket SecretDump Remote Activity - Zeek · test · high · {"product":"zeek","service":"smb_files"}
- DPAPI Domain Backup Key Extraction · test · high · {"product":"windows","service":"security"}
- DPAPI Domain Master Key Backup Attempt · test · medium · {"product":"windows","service":"security"}
- Possible Impacket SecretDump Remote Activity · test · high · {"product":"windows","service":"security","definition":"The advanced audit policy setting \"Object Access > Audit Detailed File Share\" must be configured for Success/Failure"}
- Credential Dumping Tools Service Execution - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
- Credential Dumping Tools Service Execution - System · test · high · {"product":"windows","service":"system"}
- Mimikatz Use · test · high · {"product":"windows"}
- Cred Dump Tools Dropped Files · test · high · {"category":"file_event","product":"windows"}
- HackTool - Credential Dumping Tools Named Pipe Created · test · critical · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
- HackTool - Mimikatz Execution · test · high · {"category":"process_creation","product":"windows"}
- PUA - Memory Dump Mount Via MemProcFS · experimental · high · {"category":"process_creation","product":"windows"}
- Dumping of Sensitive Hives Via Reg.EXE · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0437 Detection of LSA Secrets Dumping via Registry and Memory Extraction
AN1212 Analytic 1212
Detects adversary activity aimed at accessing LSA Secrets, including registry key export of HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets or memory scraping via tools such as Mimikatz or PowerSploit's Invoke-Mimikatz.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.