LSASS Dumping Using DFIR Tools

[@HAMETE]

As always. This channel is gold. Thanks!

[@MikeClark7]

Very cool. I always enjoy learning new things from your videos! They give me great ideas for different detections.

[@CyberAttackDefense]

Cool, thanks

[@danielabay01]

Awesome technique, learned something knew today, thanks!

[@CyberAttackDefense]

Nice! Glad you learned something.

[@cyberadvent]

This was amazing and I will be using this lol thank you!

[@BEAST4LIF3]

Funny I used the same technique with remote magnet capture but had trouble parsing out lsass with volatility. SAM worked great.

[@CyberAttackDefense]

I have done similar remotely with PCIleach installed as a service.

[@BEAST4LIF3]

@@CyberAttackDefense sounds similar to phymem2profit maybe? BTW what is the best way to reach you. I am a solo operator right now and always need people to bounce ideas off of😅.

[@CyberAttackDefense]

Twitter DM

[@erwin166]

Great!!, I like computer forensic, and I will keep this topic in mind.

[@AharonMoshe-m2g]

Thanks!!

[@niksphd2742]

I'm glad I watched this. What privileges did you need to run that .exe and successfully dump lsass? Steps up to that would be flagged easily. Our soc would also see that being run and notify the client.

[@CyberAttackDefense]

You would need to escalate to local admin level or a level that can install software. Saying your SOC would see this unless your running application allow listing or have SIEM rules in place isn’t a given. You should test this scenario.

[@crash9706]

Great content. i learn a lot from you as a red teamer. My question is, how did you learn or know about this.

[@CyberAttackDefense]

This one was brought on by a fleeting chat in a SANS chat room and experimentation. I am lucky to be around other smart people with great ideas that I can test and make into reality.

[@theuni903]

Hi Brian, thank you so much the content you are putting out. In terms of detection, would it not be more robust to look for the winpmem driver hash? As modifying it would invalidate the signature. Of course, assuming that we would have the detection capabilities and incentives

[@CyberAttackDefense]

Look for both :)

[@cvport8155]

Wow bro make more ❤❤❤

[@franciscog7110]

This is a great share. I am using it and dumped the RAM, and from it the SAM hashes using volatility3. However, it would be more useful to get the actual NTLM hashes of the AD users, and this is not in the LSA secrets method from volatility3. I thought, that maybe if I carved out somehow the process data from the Lsass.exe that is in the RAM dump it would be possible to analyze it with mimikatz minidump locally. But it just fails. Am I doing something that makes no sense?

[@CyberAttackDefense]

The hashes from volatility are the ntlm hashes. You can crack or pass them.

[@franciscog7110]

thank you for the reply​@@CyberAttackDefense. I get the local user hashes from the volatility3 plugin windows.hashdump and mimikatz returns also the NT hashes of the AD users in the same host. So I was wondering if it is possible to convert the output from Winpmem and use it on mimikatz offline. I know the DA NTLM hash is there, and then just need to pass it to end the test

[@CyberAttackDefense]

@@franciscog7110 You can dump the process with volatility and run mimikatz against it. Did you try using memdump? or if you have an older version of volatility there is a mimikatz plugin.

[@eladfern]

Great video !!! Unfortunately Microsoft requirements for Credential Guard are pretty "heavy". For example it will work only on windows Enterprise edition.

[@CyberAttackDefense]

Very true! This is the reason many orgs didn’t implement this control. Implement where possible.

[@Goun-hn6uv]

Then how to bypass credential guard?

[@CyberAttackDefense]

So you can’t really bypass credential guard. There are some other methods but the closest I have seen was what Oliver Lyak did here. research.ifcr.dk/pass-the-challenge-defeating-windows-defender-credential-guard-31a892eee22

[@Goun-hn6uv]

@@CyberAttackDefense thanks for sharing!

[@gunnerysergeant8889]

Was that from a low-priv user??

[@CyberAttackDefense]

No this is assuming admin. Find an escalation path first.

[@gunnerysergeant8889]

Okay, i see...the goal here is being quiet and stealthy!! Thank you

[@ohmsohmsohms]

Wow

[@alexanderdell2623]

Man, stop burning tools just like that😅

[@CyberAttackDefense]

Oh I have better! Not burning my real secrets