THREATNOIR
Subscribe
MITRE ATT&CK · T1003

OS Credential Dumping

MITRE · cited in 6 of our lessons

Explanation

What attackers do. Attackers dump credentials such as password hashes, Kerberos tickets or clear text passwords from operating system memory and stores, for example the LSASS process, the SAM database or domain controller data. This serves Credential Access and fuels lateral movement.

How to defend. Enable LSA protection and credential isolation features, restrict local admin rights and debug privileges, and use attack surface reduction rules that block credential stealing from LSASS. Protect domain controllers as tier zero systems and monitor directory replication requests.

Signs to look for. Look for processes accessing LSASS memory, creation of memory dump files, copies of registry hives or the directory database, and replication requests from hosts that are not domain controllers. A common gap is allowing legitimate admin tools that can also dump memory.

Open the technique on MITRE ATT&CK
The official text
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.