LSA secrets / cached credential dumping

Service secrets and cached logons pulled from the registry

categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1003.004 · Dump Kerberos Tickets from LSA using dumper.ps1 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.004 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1003.004 -TestGuids 2dfa3bff-9a27-46db-ab75-7faefdaca732 -TimeoutSeconds 120'

ATT&CK T1003.004 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.004 -Tool atomic -RunId run-2026-11-02-002 -Command 'Invoke-AtomicTest T1003.004 -TestGuids 55295ab0-a703-433b-9ca4-ae13807de12f -GetPrereqs; Invoke-AtomicTest T1003.004 -TestGuids 55295ab0-a703-433b-9ca4-ae13807de12f -TimeoutSeconds 120'

ATT&CK T1003.004 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.004 -Tool atomic -RunId run-2026-11-02-008 -Command 'Invoke-AtomicTest T1003.004 -TestGuids 55295ab0-a703-433b-9ca4-ae13807de12f -GetPrereqs; Invoke-AtomicTest T1003.004 -TestGuids 55295ab0-a703-433b-9ca4-ae13807de12f -TimeoutSeconds 120'

+ 7 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-11-02 · detected in 69s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 1	Registry credential hive dumped: reg save/export of HKLM\SAM, SECURITY (LSA secrets) or SYSTEM (boot key) -- T1003.002/T1003.004
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script executed "Expand-Archive"
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
… and 5 more event type(s)

Detection that fired

✓ Wazuh 100462 (level 12) lab rule — Registry credential hive dumped: reg save/export of HKLM\SAM, SECURITY (LSA secrets) or SYSTEM (boot key) -- T1003.002/T1003.004
✓ Wazuh 100463 (level 12) lab rule — Registry credential hive dumped: reg save/export of HKLM\SAM, SECURITY (LSA secrets) or SYSTEM (boot key) (Security 4688 arm) -- T1003.002/T1003.004

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~2400 incidental alerts/hour — tune against this.

partially detected windows · 2026-11-02

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 1	Windows command prompt started by an abnormal process
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script executed "Expand-Archive"
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
… and 7 more event type(s)

Plus 15 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~6309 incidental alerts/hour — tune against this.

Classification

25 values: 13 reviewed, 3 lab-measured, 8 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	High
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Confidentiality
Platform	LinuxWindows
Environment	On-premises
Target asset class	EndpointIdentity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	File AccessFile ModificationModule LoadProcess AccessProcess Creation

Detection & response

Mitigated by 28

M1015 attack-mitigation
M1017 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1028 attack-mitigation
D3-ABPI d3fend
D3-AEM d3fend
D3-ANCI d3fend
D3-CCSA d3fend
D3-CH d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CTS d3fend
D3-DI d3fend
D3-DUC d3fend
D3-HBPI d3fend
D3-HR d3fend
D3-HS d3fend
D3-KBPI d3fend
D3-MFA d3fend
D3-PLA d3fend
D3-PS d3fend
D3-PSA d3fend
D3-PSMD d3fend
D3-PT d3fend
D3-RD d3fend
D3-RIC d3fend
D3-SCF d3fend

Detected by 19

DET0437 attack-detection-strategy
DET0513 attack-detection-strategy
06d71506-7beb-4f22-8888-e2e5e2ca7fd8 sigma
07f8bdc2-c9b3-472a-9817-5a670b872f53 sigma
252902e3-5830-4cf6-bf21-c22083dfd5cf sigma
39a94fd1-8c9a-4ff6-bf22-c058762f8014 sigma
4976aa50-8f41-45c6-8b15-ab3fc10e79ed sigma
4ac1f50b-3bd0-4968-902d-868b4647937e sigma
8a1b2c3d-4e5f-6789-abcd-ef1234567890 sigma
8fbf3271-1ef6-4e94-8210-03c2317947f6 sigma
92dae1ed-1c9d-4eff-a567-33acbd95b00e sigma
961d0ba2-3eea-4303-a930-2cf78bbfcc5e sigma
a642964e-bead-4bed-8910-1bb4d63e3b4d sigma
b1ec66c6-f4d1-4b5c-96dd-af28ccae7727 sigma
f0d1feba-4344-4ca9-8121-a6c97bd6df52 sigma
fd877b94-9bb5-4191-bb25-d79cbd93c167 sigma
100401 wazuh
100462 wazuh
100463 wazuh

Tested by 3

2dfa3bff-9a27-46db-ab75-7faefdaca732 atomic
55295ab0-a703-433b-9ca4-ae13807de12f atomic
56506854-89d6-46a3-9804-b7fde90791f9 atomic

Attack relationships

Parent: Credential-dumping tooling

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-005`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-14-009`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-16-002`	detected	atomic	windows	2026-10-16
`run-2026-10-18-006`	detected	atomic	windows	2026-10-18
`run-2026-10-27-004`	detected	atomic	windows	2026-10-27
`run-2026-10-28-012`	detected	atomic	windows	2026-10-28
`run-2026-11-02-008`	partially-detected	atomic	windows	2026-11-02
`run-2026-11-02-013`	detected	atomic	windows	2026-11-02

run-2026-10-14-005 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.005 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=14 max_level=15 dwell_s=90
run-2026-10-14-009 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.005 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=14 max_level=15 dwell_s=90
run-2026-10-16-002 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.005 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=14 max_level=15 dwell_s=90
run-2026-10-18-006 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.005 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=1 incidental=1453 max_level=15 dwell_s=90
run-2026-10-27-004 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.005 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=1 incidental=1793 max_level=15 dwell_s=90
run-2026-10-28-012 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.005 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=1 incidental=1711 max_level=15 dwell_s=90
run-2026-11-02-008 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.004 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=0 incidental=170 max_level=15 dwell_s=90
run-2026-11-02-013 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.004 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy. [renumbered from run-2026-11-02-002 on commit: the harness reused that id because the prereq-only run-2026-11-02-002 lives in lab/results-excluded/]; expected=2 incidental=64 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1003/
attack: T1003.004 (primary)
attack: T1003.005

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 336 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 19 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 8 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-005 (partially-detected) for T1003.005: no alert matched the expected technique
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-009 (partially-detected) for T1003.005: no alert matched the expected technique
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-16) — Lab detonation run-2026-10-16-002 (detected): Wazuh rule(s) 100401 fired on T1003.005 within the detonation window
Cached credential enumeration: cmdkey /list (lists stored Credential Manager creds)
ev-0007 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-006 (detected): Wazuh rule(s) 100401 fired on T1003.005 within the detonation window
Cached credential enumeration: cmdkey /list (lists stored Credential Manager creds)
ev-0008 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-004 (detected): Wazuh rule(s) 100401 fired on T1003.005 within the detonation window
Cached credential enumeration: cmdkey /list (lists stored Credential Manager creds)
ev-0009 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-012 (detected): Wazuh rule(s) 100401 fired on T1003.005 within the detonation window
Cached credential enumeration: cmdkey /list (lists stored Credential Manager creds)
ev-0010 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-008 (partially-detected) for T1003.004: no alert matched the expected technique
ev-0011 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-013 (detected): Wazuh rule(s) 100462, 100463 fired on T1003.004 within the detonation window
Registry credential hive dumped: reg save/export of HKLM\SAM, SECURITY (LSA secrets) or SYSTEM (boot key) -- T1003.002/T1003.004