OS Credential Dumping

T1003

Technique with 8 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

Detection rules191

Rules on DetectionCode tagged with T1003 or one of its sub-techniques.

Sigma140

Rule	Level	Log source	Technique
Antivirus - Password Dumper Signature	critical	NULL / antivirus	T1003 T1003.001 T1003.002
HackTool - Credential Dumping Tools Named Pipe Created	critical	windows / pipe_created	T1003.001 T1003.002 T1003.004 T1003.005
HackTool - Dumpert Process Dumper Default File	critical	windows / file_event	T1003.001
HackTool - Dumpert Process Dumper Execution	critical	windows / process_creation	T1003.001
HackTool - Inveigh Execution	critical	windows / process_creation	T1003.001
HackTool - QuarksPwDump Dump File	critical	windows / file_event	T1003.002
HackTool - Rubeus Execution	critical	windows / process_creation	T1003
HackTool - SafetyKatz Execution	critical	windows / process_creation	T1003.001
HackTool - Windows Credential Editor (WCE) Execution	critical	windows / process_creation	T1003.001
Hacktool Execution - Imphash	critical	windows / process_creation	T1003
Potential Credential Dumping Via LSASS Process Clone	critical	windows / process_creation	T1003 T1003.001
Potential Credential Dumping Via LSASS SilentProcessExit Technique	critical	windows / registry_event	T1003.001
WCE wceaux.dll Access	critical	windows / NULL	T1003
Windows Credential Editor Registry	critical	windows / registry_event	T1003.001
Copying Sensitive Files with Credential Data	high	windows / process_creation	T1003.002 T1003.003
Create Volume Shadow Copy with Powershell	high	windows / ps_script	T1003.003
CreateDump Process Dump	high	windows / process_creation	T1003.001
Cred Dump Tools Dropped Files	high	windows / file_event	T1003.001 T1003.002 T1003.003 T1003.004 T1003.005
Credential Dumping Activity By Python Based Tool	high	windows / process_access	T1003.001
Credential Dumping Attempt Via WerFault	high	windows / process_access	T1003.001
Credential Dumping Tools Service Execution - Security	high	windows / NULL	T1003.001 T1003.002 T1003.004 T1003.005 T1003.006
Credential Dumping Tools Service Execution - System	high	windows / NULL	T1003.001 T1003.002 T1003.004 T1003.005 T1003.006
Critical Hive In Suspicious Location Access Bits Cleared	high	windows / NULL	T1003.002
DPAPI Domain Backup Key Extraction	high	windows / NULL	T1003.004
Dumping of Sensitive Hives Via Reg.EXE	high	windows / process_creation	T1003.002 T1003.004 T1003.005
Esentutl Volume Shadow Copy Service Keys	high	windows / registry_event	T1003.002
HackTool - CrackMapExec File Indicators	high	windows / file_event	T1003.001
HackTool - CrackMapExec Process Patterns	high	windows / process_creation	T1003.001
HackTool - CreateMiniDump Execution	high	windows / process_creation	T1003.001
HackTool - Doppelanger LSASS Dumper Execution	high	windows / process_creation	T1003.001
HackTool - Generic Process Access	high	windows / process_access	T1003.001
HackTool - HandleKatz Duplicating LSASS Handle	high	windows / process_access	T1003.001
HackTool - HandleKatz LSASS Dumper Execution	high	windows / process_creation	T1003.001
HackTool - Impacket File Indicators	high	windows / file_event	T1003.001
HackTool - Mimikatz Execution	high	windows / process_creation	T1003.001 T1003.002 T1003.004 T1003.005 T1003.006
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump	high	windows / file_event	T1003
HackTool - Pypykatz Credentials Dumping Activity	high	windows / process_creation	T1003.002
HackTool - Quarks PwDump Execution	high	windows / process_creation	T1003.002
HackTool - Rubeus Execution - ScriptBlock	high	windows / ps_script	T1003
HackTool - SafetyKatz Dump Indicator	high	windows / file_event	T1003.001
HackTool - WSASS Execution	high	windows / process_creation	T1003.001
HackTool - XORDump Execution	high	windows / process_creation	T1003.001
Hacktool Execution - PE Metadata	high	windows / process_creation	T1003
Linux Keylogging with Pam.d	high	linux / NULL	T1003
Live Memory Dump Using Powershell	high	windows / ps_script	T1003
LSASS Access Detected via Attack Surface Reduction	high	windows / NULL	T1003.001
LSASS Access From Potentially White-Listed Processes	high	windows / process_access	T1003.001
LSASS Dump Keyword In CommandLine	high	windows / process_creation	T1003.001
Lsass Full Dump Request Via DumpType Registry Settings	high	windows / registry_set	T1003.001
LSASS Memory Access by Tool With Dump Keyword In Name	high	windows / process_access	T1003.001
Lsass Memory Dump via Comsvcs DLL	high	windows / process_access	T1003.001
LSASS Process Crashed - Application	high	windows / NULL	T1003.001
LSASS Process Dump Artefact In CrashDumps Folder	high	windows / file_event	T1003.001
LSASS Process Memory Dump Creation Via Taskmgr.EXE	high	windows / file_event	T1003.001
LSASS Process Memory Dump Files	high	windows / file_event	T1003.001
Microsoft IIS Connection Strings Decryption	high	windows / process_creation	T1003
Microsoft IIS Service Account Password Dumped	high	windows / process_creation	T1003
Mimikatz Use	high	windows / NULL	T1003.001 T1003.002 T1003.004 T1003.006
NTDS Exfiltration Filename Patterns	high	windows / file_event	T1003.003
NTDS.DIT Creation By Uncommon Parent Process	high	windows / file_event	T1003.003
NTDS.DIT Creation By Uncommon Process	high	windows / file_event	T1003.002 T1003.003
OpenCanary - MSSQL Login Attempt Via SQLAuth	high	opencanary / application	T1003
OpenCanary - MSSQL Login Attempt Via Windows Authentication	high	opencanary / application	T1003
OpenCanary - MySQL Login Attempt	high	opencanary / application	T1003
OpenCanary - REDIS Action Command Attempt	high	opencanary / application	T1003
Password Dumper Activity on LSASS	high	windows / NULL	T1003.001
Password Dumper Remote Thread in LSASS	high	windows / create_remote_thread	T1003.001
Possible Impacket SecretDump Remote Activity	high	windows / NULL	T1003.002 T1003.003 T1003.004
Possible Impacket SecretDump Remote Activity - Zeek	high	zeek / NULL	T1003.002 T1003.003 T1003.004
Potential Adplus.EXE Abuse	high	windows / process_creation	T1003.001
Potential Credential Dumping Attempt Using New NetworkProvider - CLI	high	windows / process_creation	T1003
Potential Credential Dumping Attempt Via PowerShell Remote Thread	high	windows / create_remote_thread	T1003.001
Potential Credential Dumping Via WER	high	windows / process_creation	T1003.001
Potential Invoke-Mimikatz PowerShell Script	high	windows / ps_script	T1003
Potential LSASS Process Dump Via Procdump	high	windows / process_creation	T1003.001
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE	high	windows / process_creation	T1003.005
Potential SAM Database Dump	high	windows / file_event	T1003.002
Potential SysInternals ProcDump Evasion	high	windows / process_creation	T1003.001
Potential Windows Defender AV Bypass Via Dump64.EXE Rename	high	windows / process_creation	T1003.001
Potentially Suspicious ODBC Driver Registered	high	windows / registry_set	T1003
PowerShell Get-Process LSASS in ScriptBlock	high	windows / ps_script	T1003.001
PowerShell SAM Copy	high	windows / process_creation	T1003.002
PPL Tampering Via WerFaultSecure	high	windows / process_creation	T1003.001
Process Access via TrolleyExpress Exclusion	high	windows / process_creation	T1003.001
Process Memory Dump Via Comsvcs.DLL	high	windows / process_creation	T1003.001
Process Memory Dump via RdrLeakDiag.EXE	high	windows / process_creation	T1003.001
PUA - DIT Snapshot Viewer	high	windows / process_creation	T1003.003
PUA - Memory Dump Mount Via MemProcFS	high	windows / process_creation	T1003 T1003.001 T1003.002 T1003.004
Registry Hive File Staged Outside Standard User Profile Path	high	windows / file_event	T1003
Remote LSASS Process Access Through Windows Remote Management	high	windows / process_access	T1003.001
Renamed CreateDump Utility Execution	high	windows / process_creation	T1003.001
Sensitive File Dump Via Print.EXE	high	windows / process_creation	T1003.002 T1003.003
Sensitive File Dump Via Wbadmin.EXE	high	windows / process_creation	T1003.003
Sensitive File Recovery From Backup Via Wbadmin.EXE	high	windows / process_creation	T1003.003
Suspicious DumpMinitool Execution	high	windows / process_creation	T1003.001
Suspicious Get-ADDBAccount Usage	high	windows / ps_module	T1003.003
Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location	high	windows / image_load	T1003
Suspicious LSASS Access Via MalSecLogon	high	windows / process_access	T1003.001
Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs	high	windows / process_access	T1003.001
Suspicious Process Patterns NTDS.DIT Exfil	high	windows / process_creation	T1003.003
Suspicious Renamed Comsvcs DLL Loaded By Rundll32	high	windows / image_load	T1003.001
Suspicious SYSTEM User Process Creation	high	windows / process_creation	T1003
Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded	high	windows / image_load	T1003.001
Time Travel Debugging Utility Usage	high	windows / process_creation	T1003.001
Time Travel Debugging Utility Usage - Image	high	windows / image_load	T1003.001
VolumeShadowCopy Symlink Creation Via Mklink	high	windows / process_creation	T1003.002 T1003.003
WerFault LSASS Process Memory Dump	high	windows / file_event	T1003.001
Access To Crypto Currency Wallets By Uncommon Applications	medium	windows / file_access	T1003
Active Directory Replication from Non Machine Account - DcSync Indicator	medium	windows / NULL	T1003.006
Capture Credentials with Rpcping.exe	medium	windows / process_creation	T1003
Crash Dump Created By Operating System	medium	windows / NULL	T1003.002
Credential Manager Access By Uncommon Applications	medium	windows / file_access	T1003
DPAPI Domain Master Key Backup Attempt	medium	windows / NULL	T1003.004
Dumping Process via Sqldumper.exe	medium	windows / process_creation	T1003.001
DumpMinitool Execution	medium	windows / process_creation	T1003.001
Esentutl Gather Credentials	medium	windows / process_creation	T1003 T1003.003
File Access Of Signal Desktop Sensitive Data	medium	windows / NULL	T1003
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)	medium	windows / process_creation	T1003.003
Loaded Module Enumeration Via Tasklist.EXE	medium	windows / process_creation	T1003
LSASS Access From Non System Account	medium	windows / NULL	T1003.001
New Generic Credentials Added Via Cmdkey.EXE	medium	windows / process_creation	T1003.005
Ntdsutil Abuse	medium	windows / NULL	T1003.003
Potential Credential Dumping Activity Via LSASS	medium	windows / process_access	T1003.001
Potential Credential Dumping Attempt Using New NetworkProvider - REG	medium	windows / registry_set	T1003
Potentially Suspicious AccessMask Requested From LSASS	medium	windows / NULL	T1003.001
Potentially Suspicious GrantedAccess Flags On LSASS	medium	windows / process_access	T1003.001
Procdump Execution	medium	windows / process_creation	T1003.001
PUA - AWS TruffleHog Execution	medium	aws / NULL	T1003
Rare Subscription-level Operations In Azure	medium	azure / NULL	T1003
Shadow Copies Creation Using Operating Systems Utilities	medium	windows / process_creation	T1003 T1003.002 T1003.003
Suspicious Get-ADReplAccount	medium	windows / ps_script	T1003.006
Suspicious Machine Account Replication - DcSync Indicator	medium	windows / NULL	T1003.006
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)	medium	windows / process_creation	T1003.003
Transferring Files with Credential Data via Network Shares	medium	windows / NULL	T1003.001 T1003.002 T1003.003
Transferring Files with Credential Data via Network Shares - Zeek	medium	zeek / NULL	T1003.001 T1003.002 T1003.003
Unsigned Image Loaded Into LSASS Process	medium	windows / image_load	T1003.001
Interesting Service Enumeration Via Sc.EXE	low	windows / process_creation	T1003
NTDS.DIT Created	low	windows / file_event	T1003.003
Volume Shadow Copy Mount	low	windows / NULL	T1003.002
VSSAudit Security Event Source Registration	informational	windows / NULL	T1003.002

Splunk51

Rule	Type	Risk	Data source	Technique
Access LSASS Memory for Dump Creation	TTP	NULL	Sysmon EventID 10	T1003.001
Attacker Tools On Endpoint	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1003
Attempted Credential Dump From Registry via Reg exe	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.002
Azure AD Privileged Authentication Administrator Role Assigned	TTP	NULL	Azure Active Directory Add member to role	T1003.002
Azure AD Privileged Graph API Permission Assigned	TTP	NULL	Azure Active Directory Update application	T1003.002
Cisco Secure Firewall - High Priority Intrusion Classification	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1003
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1003.001
Create Remote Thread into LSASS	TTP	NULL	Sysmon EventID 8	T1003.001
Creation of lsass Dump with Taskmgr	TTP	NULL	Sysmon EventID 11	T1003.001
Creation of Shadow Copy	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.003
Creation of Shadow Copy with wmic and powershell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.003
Credential Dumping via Copy Command from Shadow Copy	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.003
Credential Dumping via Symlink to Shadow Copy	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.003
Detect Copy of ShadowCopy with Script Block Logging	TTP	NULL	Powershell Script Block Logging 4104	T1003.002
Detect Credential Dumping through LSASS access	TTP	NULL	Sysmon EventID 10	T1003.001
Detect Mimikatz Using Loaded Images	TTP	NULL	Sysmon EventID 7	T1003.001
Detect Mimikatz Via PowerShell And EventCode 4703	TTP	NULL		T1003.001
Detect Mimikatz With PowerShell Script Block Logging	TTP	NULL	Powershell Script Block Logging 4104	T1003
Dump LSASS via comsvcs DLL	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.001
Dump LSASS via procdump	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.001
Dump LSASS via procdump Rename	Hunting	NULL	Sysmon EventID 1	T1003.001
Enable WDigest UseLogonCredential Registry	TTP	NULL	Sysmon EventID 13	T1003
Esentutl SAM Copy	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.002
ESXi Sensitive Files Accessed	TTP	NULL	VMWare ESXi Syslog	T1003.008
Excel Spawning PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.002
Excel Spawning Windows Script Host	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.002
Extraction of Registry Hives	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.002
Linux Auditd Possible Access To Credential Files	Anomaly	NULL	Linux Auditd Proctitle	T1003.008
Linux Possible Access To Credential Files	Anomaly	NULL	Sysmon for Linux EventID 1	T1003.008
Ntdsutil Export NTDS	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.003
O365 Privileged Graph API Permission Assigned	TTP	NULL	O365 Update application.	T1003.002
PetitPotam Suspicious Kerberos TGT Request	TTP	NULL	Windows Event Log Security 4768	T1003
PowerShell 4104 Hunting	Hunting	NULL	Powershell Script Block Logging 4104	T1003
SAM Database File Access Attempt	Hunting	NULL	Windows Event Log Security 4663	T1003.002
SecretDumps Offline NTDS Dumping Tool	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.003
Unsigned Image Loaded by LSASS	TTP	NULL	Sysmon EventID 7	T1003.001
Windows AD Replication Request Initiated by User Account	TTP	NULL	Windows Event Log Security 4662, Windows Event Log Security 4624	T1003.006
Windows AD Replication Request Initiated from Unsanctioned Location	TTP	NULL	Windows Event Log Security 4662, Windows Event Log Security 4624	T1003.006
Windows AD Replication Service Traffic	TTP	NULL		T1003.006
Windows Cached Domain Credentials Reg Query	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.005
Windows Credential Dumping LSASS Memory Createdump	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.001
Windows Hunting System Account Targeting Lsass	Hunting	NULL	Sysmon EventID 10	T1003.001
Windows LAPS Password Gathering Via PowerShell Script	Anomaly	NULL	Powershell Script Block Logging 4104	T1003
Windows LSA Secrets NoLMhash Registry	TTP	NULL	Sysmon EventID 13	T1003.004
Windows Mimikatz Binary Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003
Windows Non-System Account Targeting Lsass	TTP	NULL	Sysmon EventID 10	T1003.001
Windows Possible Credential Dumping	Anomaly	NULL	Sysmon EventID 10	T1003.001
Windows Post Exploitation Risk Behavior	Correlation	NULL		T1003
Windows Rapid Authentication On Multiple Hosts	TTP	NULL	Windows Event Log Security 4624	T1003.002
Windows Remote Access Software BRC4 Loaded Dll	Anomaly	NULL	Sysmon EventID 7	T1003
Windows Sensitive Registry Hive Dump Via CommandLine	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1003.002

Sub-techniques8

ID	Name	Examples
T1003.001	LSASS Memory	79
T1003.002	Security Account Manager	36
T1003.003	NTDS	26
T1003.004	LSA Secrets	19
T1003.005	Cached Domain Credentials	8
T1003.006	DCSync	8
T1003.007	Proc Filesystem	5
T1003.008	/etc/passwd and /etc/shadow	2

Groups13

Software7

Carbanak HOMEFRY MgBot OnionDuke PinchDuke Revenge RAT Trojan.Karagany

Campaigns0

None recorded.

Procedure examples20

Groups13

Used by	Procedure example
GroupAPT28	APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. DOJ GRU Indictment Jul 2018 ESET Sednit Part 2 US District Court Indictment GRU Oct 2018
GroupAPT32	APT32 used GetPassword_x64 to harvest credentials. Cybereason Cobalt Kitty 2017 Cybereason Oceanlotus May 2017
GroupAPT39	APT39 has used different versions of Mimikatz to obtain credentials. BitDefender Chafer May 2020
GroupAxiom	Axiom has been known to dump credentials. Novetta-Axiom
GroupBlackByte	BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems. Microsoft BlackByte 2023 Picus BlackByte 2022
GroupEmber Bear	Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments. Cadet Blizzard emerges as novel threat actor
GroupLeviathan	Leviathan has used publicly available tools to dump password hashes, including HOMEFRY. FireEye APT40 March 2019
GroupMustang Panda	Mustang Panda utilized “Hdump” to dump credentials from memory. Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

View all 13 groups examples

Software7

Used by	Procedure example
MalwareCarbanak	Carbanak obtains Windows logon password details. FireEye CARBANAK June 2017
MalwareHOMEFRY	HOMEFRY can perform credential dumping. FireEye Periscope March 2018
MalwareMgBot	MgBot includes modules for dumping and capturing credentials from process memory. Symantec Daggerfly 2023
MalwareOnionDuke	OnionDuke steals credentials from its victims. F-Secure The Dukes
MalwarePinchDuke	PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP). F-Secure The Dukes
MalwareRevenge RAT	Revenge RAT has a plugin for credential harvesting. Cylance Shaheen Nov 2018
MalwareTrojan.Karagany	Trojan.Karagany can dump passwords and save them into `\ProgramData\Mail\MailAg\pwds.txt`. Symantec Dragonfly

References1

Brining MimiKatz to Unix Open source
Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.