Procedure examples

Fox Kitten has used prodump to dump credentials from LSASS.

Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.

Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.

Wizard Spider has dumped the lsass.exe memory to harvest credentials with the use of open-source tool LaZagne.

Moonstone Sleet retrieved credentials from LSASS memory.

VOID MANTICORE has dumped LSASS credentials using `comsvcs.dll` via `rundll32.exe`.

Play has used Mimikatz and the Windows Task Manager to dump LSASS process memory.

PLATINUM has used keyloggers that are also capable of dumping credentials.

Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.

Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.

APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.

FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).

FIN13 has obtained memory dumps with ProcDump to parse and extract credentials from a victim's LSASS process memory with Mimikatz.

GALLIUM used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.

APT41 extracted user account data from the Security Account Managerr (SAM), making a copy of this database from the registry using the reg save command or by exploiting volume shadow copies.

Dragonfly has dropped and executed SecretsDump to dump password hashes.

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.

Ke3chang has dumped credentials, including by using gsecdump.

APT29 has used the `reg save` command to save registry hives.

MirrorFace has used vssadmin to copy registry hives including SAM.

Ember Bear acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as reg save.

Agrius dumped the SAM file on victim machines to capture credentials.

APT5 has copied and exfiltrated the SAM Registry hive from targeted systems.

Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.

Daggerfly used Reg to dump the Security Account Manager (SAM) hive from victim machines for follow-on credential extraction.

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

FIN13 has extracted the SAM and SYSTEM registry hives using the `reg.exe` binary for obtaining password hashes from a compromised machine.

Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.

APT41 used ntdsutil to obtain a copy of the victim environment ntds.dit file.

Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.

menuPass has used Ntdsutil to dump credentials.

HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.

Sandworm Team has used `ntdsutil.exe` to back up the Active Directory database, likely for credential access.

Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.

Scattered Spider has extracted the `NTDS.dit` file by creating volume shadow copies of virtual domain controller disks.

Ke3chang has used NTDSDump and other password dumping tools to gather credentials.

Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.

MirrorFace has dumped NTDS.dit through volume shadow copies.

Medusa Group has accessed the ntds.dit file to engage in credential dumping.

APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.

Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.

LAPSUS$ has used Windows built-in tool `ntdsutil` to extract the Active Directory (AD) database.

Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database. Wizard Spider has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.

FIN13 has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it.

Dragonfly has dropped and executed SecretsDump to dump password hashes.

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.

MuddyWater has performed credential dumping with LaZagne.

Leafminer used several tools for retrieving login and password information, including LaZagne.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.