Windows Services with Cached Credentials (LSA Secrets)

info Nessus Plugin ID 365664

Synopsis

One or more Windows services on the remote host have cached credentials in LSA Secrets.

Description

One or more Windows services on the remote host are configured to run as a domain or local user account rather than a built-in account (LocalSystem, LocalService, or NetworkService).
Windows automatically caches these account credentials in the LSA Secrets store (HKLM\SECURITY\Policy\Secrets\_SC_<ServiceName>), making them potentially extractable via OS Credential Dumping techniques (T1003.004).

Plugin Details

Severity: Info

ID: 365664

File Name: smb_svc_cached_credentials.nasl

Version: 1.1

Type: Local

Agent: windows

Family: Windows

Published: 10/14/2026

Updated: 10/14/2026

Supported Sensors: Nessus Agent, Nessus

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Required KB Items: SMB/svcs

Detections

Analytics