Every Windows machine holds onto secrets like service accounts, passwords, cached keys, etc. that can be found in multiple places in the OS, one of them being the Local Security Authority (LSA). 

LSA Secrets came up briefly in Windows Credentials, sitting alongside SAM, LSASS memory, and NTDS.dit as one of the places Windows keeps sensitive material. This room takes that one entry and digs deep on how it's actually dumped in practice, using more than one method, and what each method leaves behind once you go hunting afterwards.

We will explore the different techniques used by threat actors to dump LSA Secrets.

Learning Objectives

In this room, we will:

• Understand what the LSA Secrets are and why defenders should care about them
• Understand why attackers specifically target LSA Secrets over other credential stores
• Identify the tools and techniques used to extract LSA Secrets from a Windows host
• Analyze Windows Event Log, Sysmon and Windows artifacts to detect this attack

Prerequisites

• Complete the Windows Credentials room.

Lab Access

Before moving forward, start the lab by clicking the Start Machine button below. You may also want to use DefenseBox for this room. It isn't required, but it's useful for experimenting with the artifacts and digging deeper than the room's practical exercises cover.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your DefenseBox and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Defender machine

Status:Off

Lab machine

Status:Off

Start Lab Machine