ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Software: S0002×

17 examples

Technique	Used by	Procedure example
T1003.001 LSASS Memory	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.002 Security Account Manager	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.004 LSA Secrets	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.006 DCSync	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync. Cobalt Strike Manual 4.3 November 2020 Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1098 Account Manipulation	ToolMimikatz	The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The `LSADUMP::ChangeNTLM` and `LSADUMP::SetNTLM` modules can also manipulate the password hash of an account without knowing the clear text value. Adsecurity Mimikatz Guide Metcalf 2015
T1134.005 SID-History Injection	ToolMimikatz	Mimikatz's `MISC::AddSid` module can append any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain. AdSecurity Kerberos GT Aug 2015 Adsecurity Mimikatz Guide
T1207 Rogue Domain Controller	ToolMimikatz	Mimikatz’s `LSADUMP::DCShadow` module can be used to make AD updates by temporarily setting a computer to be a DC. Adsecurity Mimikatz Guide Deply Mimikatz
T1547.005 Security Support Provider	ToolMimikatz	The Mimikatz credential dumper contains an implementation of an SSP. Deply Mimikatz
T1550.002 Pass the Hash	ToolMimikatz	Mimikatz's `SEKURLSA::Pth` module can impersonate a user, with only a password hash, to execute arbitrary commands. Adsecurity Mimikatz Guide Cobalt Strike Manual 4.3 November 2020 NCSC Joint Report Public Tools
T1550.003 Pass the Ticket	ToolMimikatz	Mimikatz’s `LSADUMP::DCSync` and `KERBEROS::PTT` modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets. AdSecurity Kerberos GT Aug 2015 Adsecurity Mimikatz Guide Harmj0y DCSync Sept 2015 NCSC Joint Report Public Tools
T1552.004 Private Keys	ToolMimikatz	Mimikatz's `CRYPTO::Extract` module can extract keys by interacting with Windows cryptographic application programming interface (API) functions. Adsecurity Mimikatz Guide
T1555 Credentials from Password Stores	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI. Cobalt Strike Manual 4.3 November 2020 Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1555.003 Credentials from Web Browsers	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1555.004 Windows Credential Manager	ToolMimikatz	Mimikatz contains functionality to acquire credentials from the Windows Credential Manager. Delpy Mimikatz Crendential Manager
T1558.001 Golden Ticket	ToolMimikatz	Mimikatz's kerberos module can create golden tickets. Cobalt Strike Manual 4.3 November 2020 GitHub Mimikatz kerberos Module
T1558.002 Silver Ticket	ToolMimikatz	Mimikatz's kerberos module can create silver tickets. GitHub Mimikatz kerberos Module
T1649 Steal or Forge Authentication Certificates	ToolMimikatz	Mimikatz's `CRYPTO` module can create and export various types of authentication certificates. Adsecurity Mimikatz Guide

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.