Wiki : ./Security/Windows/AD/Authentication/LSA.md

Description

Use: Mimikatz

LSA secrets can be used to decrypt certain stored credentials on a device.

Dumped LSA credentials have the following format:

[domain]/user:$DCC2$10240#[User]#[hash]

Hashcat can be used for cracking

hashcat -m2100 [hash.file] [wordlist.file]