Enable LSA protections - Mimikatz

[ksnihur]

Description: Looks to see if the lsass process is protected

What The Data Shows: It will show what machines do not have lsass protections in place. This can lead to reading or injecting lsass to read hashes. If the result is 1, it means LSA protections is enabled.  

SQL: 

SELECT name,type,

    CASE cnt

        WHEN 0 THEN "DISABLED"

        ELSE "ENABLED"

    END "LSM Protection",

    datetime(mtime,"unixepoch","localtime") AS last_registry_write

FROM (SELECT *,COUNT(*) AS cnt

              FROM registry

              WHERE 

             path='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\LSA\\RunAsPPL');

[jnelson]

@ksnihur this type of query will only return results if the LSA protections are in place, because otherwise the key does not exist. The lack of any results could confuse people. When you are creating queries like these I suggest using something similar to the following query as it will tell the user if the protections are enabled or not:

SELECT name,type,

    CASE cnt

        WHEN 0 THEN "DISABLED"

        ELSE "ENABLED"

    END "LSM Protection",

    datetime(mtime,"unixepoch","localtime") AS last_registry_write

FROM (SELECT *,COUNT(*) AS cnt

              FROM registry

              WHERE 

             path='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\LSA\\RunAsPPL');

[ksnihur]

Thanks @jnelson , change has been updated and I'll use this for a couple other I'm writing.