In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, only use it to auth to the endpoint. I use heightened accounts to parse logs, manage configs, etc on endpoints. Since my account technically logs in every WMI hit it makes (visible in the event log) does this also mean that creds passed with WMI and powershell are stored in lsass and potentially visible to procdump or mimikatz like module/framework?

Thanks so much for any insight or thoughts into this!


My new found understanding: Two types of logons for this- one stores and one doesn't:

Interactive logon occurs when a user enters their logon creds at boot, RDP, or other interface on the local machine. This logon type injects user’s credentials into memory as Kerberos tickets TGT, NTLM, LM, or plain text. This logon type is the primary security concern when dealing with mimikatz, TGT spoofing, procdump, and PTH attacks. In other words interactive logins need to be kept to LEAST privilage.

Network logons user’s credentials are authed to the destination system in order to access or remotely admin. These credentials types are not passsed to the service/system and therefore not stored on the remote system in memory as any of the above mentioned string types.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.