Lslsass

S0121

Tool.View on attack.mitre.org

About this tool

Lslsass is a publicly-available tool that can dump active logon session password hashes from the lsass process.

Techniques used1

Procedure examples1

TechniqueProcedure example
T1003.001
LSASS Memory

Lslsass can dump active logon session password hashes from the lsass process.

Groups that use it1

Campaigns0

None recorded.

References1

  1. Mandiant APT1 Open source
    Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.