Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)

[Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)
LSA Secrets
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1003/004  external_id: T1003.004     source_name: Passcape LSA Secrets  description: Passcape. (n.d.). Windows LSA secrets. Retrieved February 21, 2020.  url: https://www.passcape.com/index.php?section=docsys&cmd=details&id=23     source_name: Microsoft AD Admin Tier Model  description: Microsoft. (2019, February 14). Active Directory administrative tier model. Retrieved February 21, 2020.  url: https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material?redirectedfrom=MSDN     source_name: Tilbury Windows Credentials  description: Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack, Mitigation, Defense. Retrieved February 21, 2020.  url: https://www.first.org/resources/papers/conf2017/Windows-Credentials-Attacks-and-Mitigation-Techniques.pdf     source_name: ired Dumping LSA Secrets  description: Mantvydas Baranauskas. (2019, November 16). Dumping LSA Secrets. Retrieved February 21, 2020.  url: https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets     source_name: Powersploit  description: PowerSploit. (n.d.). Retrieved December 4, 2014.  url: https://github.com/mattifestation/PowerSploit     