> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/active-directory/post-exploitation/lsass-and-sam.md).

# LSASS and SAM

## LSASS

LSASS is the king of post-exploitation targets in Windows environments. LSASS contains cached credentials for logon sessions, Kerberos tickets, and other secrets. This is the ideal target, but these days EDR vendors have it pretty locked down. Dumping smaller parts of the the LSASS process is less likely to get noticed, such as only grabbing Kerberos tickets.

The classic LSASS dump method is just to use `mimikatz`. There's countless other options and ports at this point, each made in different languages and for different reasons. Here are a few.

```
mimikatz sekurlsa::logonpasswords
nxc smb 10.10.10.10 -u admin -p pass --lsa
```

## SAM

The SAM contains NTLM hashes of local-only accounts. This is useful to grab the local Administrator NTLM hash, but that's probably about it.

```
mimikatz lsadump::sam
nxc smb 10.10.10.10 -u admin -p --sam
```