Credential Dumping: NTLM Hash Dump

What is NTLM?

NTLM (NT LAN Manager) is a suite of Microsoft security protocols designed to provide authentication and encryption for users accessing network resources. NTLM was introduced in the early versions of Windows and is now largely considered outdated, yet it remains prevalent in various systems due to compatibility with legacy applications and networks.

Data Stored in NTLM:

NTLM stores crucial credential data in the form of hashes rather than plaintext passwords, enhancing security by preventing exposure of actual passwords. The primary types of data associated with NTLM include:

1. 
   User Password Hashes: NTLM generates a hash from a user’s password, which is stored in a secure location. When a user attempts to authenticate, the system hashes the input password and compares it to the stored hash.


2. 
   Challenge/Response Mechanism: NTLM uses a challenge/response mechanism for authentication. When a user logs in, the server sends a challenge to the client. The client then uses its password hash to compute a response, which is sent back to the server for validation.


3. 
   Session Keys: NTLM can generate session keys during authentication to encrypt communications between the client and server, ensuring confidentiality and integrity of data exchanged during the session.


4. 
   Security Identifiers (SIDs): NTLM also utilizes SIDs to uniquely identify users and groups within Windows environments, facilitating access control and permissions management.

What is NTLM Credential Dumping?

NTLM Credential dumping is a critical post-exploitation activity where an attacker collects NTLM hashes from a compromised Windows system.

Once attackers extract NTLM hashes, they can use them in pass-the-hash attacks, enabling unauthorized access or lateral movement within a network. This article outlines the methods of NTLM hash extraction, detection strategies and the chances of generating false positives when detecting these activities using SIEM and EDR queries.

NTLM hashes are commonly found in two locations:

1. 
   In a workstation: Inside the memory of LSASS (Local Security Authority Subsystem Service).


2. 
   In a domain controller: Inside the NTDS.dit file.

Various Methods for Extracting NTLM Memory

Various techniques, such as using ProcDump, PowerSploit or Mimikatz, enable attackers to extract NTLM hashes from system memory, risking unauthorized access. This article covers each method in detail, including detection techniques and false positive chances.

1. Using ProcDump (Windows Native Utility)

ProcDump is a legitimate Windows utility commonly used for creating process memory dumps. Attackers use it to avoid detection while capturing sensitive data from LSASS memory.

Example Command:

procdump.exe -accepteula -ma lsass.exe lsass.dmp

Detection Query:

• SIEM: event_id:4688 AND process_name:"procdump.exe" AND command_line:"lsass.exe"
  


• EDR: command_line contains "procdump.exe" AND command_line contains "lsass.exe"
  

False Positive Chances:

• Medium - Windows administrators can use ProcDump to create an LSASS memory dump for debugging purposes.

2. Using comsvcs.dll (Windows Native DLL)

Attackers can use the comsvcs.dll library to directly dump LSASS memory. This is often seen as a less conspicuous method because it’s a native Windows DLL.

Example Command:

rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id <Path\to\dump> full

Detection Query:

• SIEM: event_id:4688 AND process_name:"rundll32.exe" AND command_line:"comsvcs.dll" AND command_line:"minidump"
  


• EDR: process_name contains "rundll32.exe" AND command_line contains "comsvcs.dll, minidump"
  

False Positive Chances:

• Low - rundll32.exe is a legitimate Windows utility and it's abuse with comsvcs.dll is unusual.

3. Using PowerSploit MiniDump

PowerSploit’s MiniDump function allows attackers to dump LSASS memory through PowerShell. This method can evade detection if PowerShell script-block logging is not enabled. The attacker uses PowerShell to dump LSASS memory with Out-MiniDump.

Example Command:

Get-Process lsass | Out-MiniDump

Detection Query:

• SIEM: event_id:4104 AND process_name:"powershell.exe" AND command_line:"Out-MiniDump" (NOTE: PowerShell event logging must be enabled)


• EDR: process_name contains "powershell.exe" AND command_line contains "Out-MiniDump"
  

False Positive Chances:

• Low - Usage of Out-MiniDump is very unusual.

4. Using SekurLSA (Mimikatz)

Mimikatz is a tool commonly used for credential dumping. It can dump LSASS memory, extract NTLM hashes, and perform pass-the-hash attacks.

Example Command:

sekurlsa::Minidump lsass.dmp

sekurlsa::logonPasswords

sekurlsa::pth

Detection Query:

• EDR: process_name contains "mimikatz.exe" OR command_line contains "sekurlsa::"
  

False Positive Chances:

• Very Low - Almost exclusively used for malicious purposes.

5. Using Windows Credential Editor (WCE)

WCE is another utility capable of extracting live NTLM hashes from a machine.

Example Command:

wce64.exe

wce32.exe

Detection Query:

• EDR: process_name contains "wce64.exe" OR process_name contains "wce32.exe" OR process_name contains "wce.exe"
  

False Positive Chances:

• Very Low - Uncommon in legitimate operations.