This note documents detection patterns related to LAPS Abuse within Active Directory environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
Security	4662	Operation performed on object	Critical	LAPS passwords are retrieved via LDAP reads of the ms-Mcs-AdmPwd attribute. Monitor object access events.
Security	4624	Successful logon	High	Attacker may authenticate using retrieved local admin password shortly after retrieval.
Security	4672	Special privileges assigned	High	Local admin login on systems using LAPS credentials.
Security	5140	Network share accessed	Medium	Possible SMB access to systems using newly obtained local admin credentials.
Sysmon	1	Process creation	Medium	Execution of tools like PowerView or LAPSToolkit retrieving passwords.
Sysmon	3	Network connection	Medium	LDAP queries to domain controllers retrieving LAPS attributes.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
LDAP reads of ms-Mcs-AdmPwd	Account querying LAPS password attribute	Critical	Primary artifact of LAPS abuse.
Multiple LAPS queries	Rapid retrieval of passwords for many computers	High	Possible attacker enumerating credentials.
Authentication with local admin accounts	Local admin login shortly after password retrieval	Critical	Strong indicator of credential abuse.
LDAP queries from workstation	Password queries from non-admin host	High	Potential attacker workstation.
Access to multiple systems	Authentication attempts using retrieved passwords	High	Indicates lateral movement.

Common Tools

Tool	Usage
PowerView	Retrieves LAPS passwords using LDAP queries.
LAPSToolkit	PowerShell module specifically targeting LAPS enumeration.
CrackMapExec	Uses retrieved LAPS passwords for lateral movement.
Impacket	Remote execution using local admin credentials.
ADSI / LDAP tools	Manual queries retrieving ms-Mcs-AdmPwd attribute.

Relevant Artifacts

Domain controller Security logs (4662)
LDAP query logs
Active Directory object metadata
Sysmon logs (1, 3)
EDR telemetry identifying credential enumeration tools
Authentication logs on target hosts
Prefetch artifacts showing execution of PowerView or LAPSToolkit
SMB and remote execution logs

MITRE ATT&CK References

T1003 Credential Dumping
T1552 Unsecured Credentials
T1078 Valid Accounts

Decision Tree

Is the suspicious event present?
- Identify object access events (4662) reading ms-Mcs-AdmPwd.
What host generated the event?
- Determine workstation performing LDAP query.
Is the account expected to perform this action?
- Investigate whether account normally retrieves LAPS passwords.
Pivot:
- Source host → inspect execution of PowerView or LAPSToolkit.
- Target systems → check authentication logs for local admin usage.
- Network → analyze SMB or remote execution activity.
Confirm exploitation
- Determine whether attacker retrieved LAPS password and used it for lateral movement.

Example Detection Templates

KQL

SecurityEvent
| where EventID == 4662
| where ObjectName contains "ms-Mcs-AdmPwd"

SecurityEvent
| where EventID == 4624
| where LogonType == 3

EQL

any where event.code == "4662"

Sigma

title: Suspicious LAPS Password Access
id: laps-abuse-detection
status: experimental
description: Detects LDAP reads of LAPS password attribute
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectName|contains: ms-Mcs-AdmPwd
  condition: selection
fields:
  - SubjectUserName
  - ObjectName
falsepositives:
  - Legitimate administrators retrieving LAPS passwords
level: high
tags:
  - attack.credential_access
  - attack.t1552

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
Privilege review	Restrict who can read LAPS attributes	Critical	Prevents unauthorized password retrieval.
Monitoring	Alert on reads of ms-Mcs-AdmPwd attribute	Critical	Primary detection strategy.
Least privilege	Limit accounts allowed to query LAPS passwords	High	Reduces attack surface.
Network monitoring	Monitor lateral movement using local admin accounts	High	Detects abuse after password retrieval.
Password rotation	Ensure LAPS password rotation policies enforced	Medium	Limits usefulness of stolen credentials.