gsecdump

S0008

Tool.View on attack.mitre.org

About this tool

gsecdump is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems.

Techniques used2

Procedure examples2

TechniqueProcedure example
T1003.002
Security Account Manager

gsecdump can dump Windows password hashes from the SAM.

T1003.004
LSA Secrets

gsecdump can dump LSA secrets.

Groups that use it5

Campaigns1

References1

  1. TrueSec Gsecdump Open source
    TrueSec. (n.d.). gsecdump v2.0b5. Retrieved November 17, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.