LSASS Dumping Using DFIR Tools

In today's video, I show a way to dump LSASS without dumping just the LSASS process. We are using DFIR tools to dump all of the memory, exfil the file created, and then dump the credentials of the box. This is a foolproof method and will get by almost every EDR solution. You will have to deal with a large file size, but in today's day and age, this isn't as big of a problem as it has been in the past.
WinPmem
github.com/Velocidex/WinPmem/...
Volatility
github.com/volatilityfoundati...
Chapters
00:00 Introduction
00:28 Credential Guard
02:05 WinPmem
04:18 Dumping Memory
05:31 SIEM Rules for Detection of Memory Dumping
07:52 Dumping Creds with Volatility
10:36 Please Turn on Credential Guard! Do IT Now!
10:57 Outro

[@HAMETE]

As always. This channel is gold. Thanks!

[@MikeClark7]

Very cool. I always enjoy learning new things from your videos! They give me great ideas for different detections.

[@CyberAttackDefense]

Cool, thanks

[@cyberadvent]

This was amazing and I will be using this lol thank you!

[@danielabay01]

Awesome technique, learned something knew today, thanks!

[@CyberAttackDefense]

Nice! Glad you learned something.

[@erwin166]

Great!!, I like computer forensic, and I will keep this topic in mind.

[@crash9706]

Great content. i learn a lot from you as a red teamer. My question is, how did you learn or know about this.

[@CyberAttackDefense]

This one was brought on by a fleeting chat in a SANS chat room and experimentation. I am lucky to be around other smart people with great ideas that I can test and make into reality.

[@BEAST4LIF3]

Funny I used the same technique with remote magnet capture but had trouble parsing out lsass with volatility. SAM worked great.

[@CyberAttackDefense]

I have done similar remotely with PCIleach installed as a service.

[@BEAST4LIF3]

@@CyberAttackDefense sounds similar to phymem2profit maybe? BTW what is the best way to reach you. I am a solo operator right now and always need people to bounce ideas off of😅.

[@CyberAttackDefense]

Twitter DM

[@theuni903]

Hi Brian, thank you so much the content you are putting out. In terms of detection, would it not be more robust to look for the winpmem driver hash? As modifying it would invalidate the signature. Of course, assuming that we would have the detection capabilities and incentives

[@CyberAttackDefense]

Look for both :)

[@eladfern]

Great video !!!
Unfortunately Microsoft requirements for Credential Guard are pretty "heavy". For example it will work only on windows Enterprise edition.

[@CyberAttackDefense]

Very true! This is the reason many orgs didn’t implement this control. Implement where possible.

[@cvport8155]

Wow bro make more ❤❤❤

[@ohmsohmsohms]

Wow

[@franciscog7110]

This is a great share. I am using it and dumped the RAM, and from it the SAM hashes using volatility3. However, it would be more useful to get the actual NTLM hashes of the AD users, and this is not in the LSA secrets method from volatility3. I thought, that maybe if I carved out somehow the process data from the Lsass.exe that is in the RAM dump it would be possible to analyze it with mimikatz minidump locally. But it just fails. Am I doing something that makes no sense?

[@CyberAttackDefense]

The hashes from volatility are the ntlm hashes. You can crack or pass them.

[@franciscog7110]

thank you for the reply​@@CyberAttackDefense. I get the local user hashes from the volatility3 plugin windows.hashdump and mimikatz returns also the NT hashes of the AD users in the same host. So I was wondering if it is possible to convert the output from Winpmem and use it on mimikatz offline. I know the DA NTLM hash is there, and then just need to pass it to end the test

[@CyberAttackDefense]

@@franciscog7110 You can dump the process with volatility and run mimikatz against it. Did you try using memdump? or if you have an older version of volatility there is a mimikatz plugin.

[@Goun-hn6uv]

Then how to bypass credential guard?

[@CyberAttackDefense]

So you can’t really bypass credential guard. There are some other methods but the closest I have seen was what Oliver Lyak did here. research.ifcr.dk/pass-the-challenge-defeating-windows-defender-credential-guard-31a892eee22

[@Goun-hn6uv]

@@CyberAttackDefense thanks for sharing!

[@gunnerysergeant8889]

Was that from a low-priv user??

[@CyberAttackDefense]

No this is assuming admin. Find an escalation path first.

[@gunnerysergeant8889]

Okay, i see...the goal here is being quiet and stealthy!! Thank you

[@alexanderdell2623]

Man, stop burning tools just like that😅

[@CyberAttackDefense]

Oh I have better! Not burning my real secrets