Procedure examples

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.

Fgdump can dump Windows password hashes.

pwdump can be used to dump credentials from the SAM.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.

gsecdump can dump Windows password hashes from the SAM.

CrackMapExec can dump usernames and hashed passwords from the SAM.

Koadic can gather hashed passwords by dumping SAM/SECURITY hive.

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.

esentutl can copy `ntds.dit` using the Volume Shadow Copy service.

CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.

Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.

CosmicDuke collects LSA secrets.

IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\*\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\*\OldVal`.

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.

AADInternals can dump secrets from the Local Security Authority.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA.

gsecdump can dump LSA secrets.

LaZagne can perform credential dumping from LSA secrets to obtain account and password information.

CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.

Pupy can use Lazagne for harvesting credentials.

Okrum was seen using modified Quarks PwDump to perform credential dumping.

LaZagne can perform credential dumping from MSCache to obtain account and password information.

Cachedump can extract cached password hashes from cache entry information.

Pupy can use Lazagne for harvesting credentials.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.

PACEMAKER has the ability to extract credentials from OS memory.

MimiPenguin can use the `<PID>/maps` and `<PID>/mem` file to search for regex patterns and dump the process memory.

LaZagne can use the `<PID>/maps` and `<PID>/mem` files to identify regex patterns to dump cleartext passwords from the browser's process memory.

TeamPCP Cloud Stealer can scrape memory from the Runner.Worker process by reading `/proc/<pid>/mem` to extract secrets including plaintext tokens.

Mini Shai-Hulud has scraped runner process memory to extract short-lived identity tokens, which it then exchanged for per-package npm trusted-publisher tokens.

LaZagne can obtain credential information from /etc/shadow using the shadow.py module.

TrickBot collects local files and information from the victim’s local machine.

BLINDINGCAN has uploaded files from victim machines.

RCSession can collect data from a compromised host.

QuietSieve can collect files from a compromised host.

Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.

BRICKSTORM has commands that allow the actor download files from the compromised host to the C2 server, and to also download specific sections of a file.

Amadey can collect information from a compromised host.

Proxysvc searches the local system and gathers data.

yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.

KOPILUWAK can gather information from compromised hosts.

Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.

Misdat has collected files and data from a compromised host.

Ursnif has collected files from victim machines, including certificates and cookies.

CASTLETAP can execute a C2 command to transfer files from victim machines.

ThreatNeedle can collect data and files from a compromised host.

Havoc can download files from the victim's computer.

FrameworkPOS can collect elements related to credit card data from process memory.

GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.

InvisibleFerret has collected data utilizing a script that contained a list of excluded files and directory names and naming patterns of interest such as environment and configuration files, documents, spreadsheets, and other files that contained the words secret, wallet, private, and password.