[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1003":3},{"item":4,"lessons":18,"controls":44,"related":73},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1003","T1003","OS Credential Dumping",6,"MITRE","**What attackers do.** Attackers dump credentials such as password hashes, Kerberos tickets or clear text passwords from operating system memory and stores, for example the LSASS process, the SAM database or domain controller data. This serves Credential Access and fuels lateral movement.\n\n**How to defend.** Enable LSA protection and credential isolation features, restrict local admin rights and debug privileges, and use attack surface reduction rules that block credential stealing from LSASS. Protect domain controllers as tier zero systems and monitor directory replication requests.\n\n**Signs to look for.** Look for processes accessing LSASS memory, creation of memory dump files, copies of registry hives or the directory database, and replication requests from hosts that are not domain controllers. A common gap is allowing legitimate admin tools that can also dump memory.","Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.\n\nSeveral of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1003\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"ai-powered-malware-autonomously-executes-post-compromise-attack-chains","AI-Powered Malware Autonomously Executes Post-Compromise Attack Chains","2026-09-22T20:21:14.78+00:00",{"slug":25,"title":26,"published_at":27},"silent-active-directory-takeover-via-legitimate-protocols","Silent Active Directory Takeover via Legitimate Protocols","2026-09-02T16:21:40.262+00:00",{"slug":29,"title":30,"published_at":31},"chinese-speaking-apt-deploys-octlurk-silklurk-backdoors-against-central-asian-governments","Chinese-Speaking APT Deploys OctLurk & SilkLurk Backdoors Against Central Asian Governments","2026-07-31T20:20:26.595+00:00",{"slug":33,"title":34,"published_at":35},"memory-resident-backdoors-octlurk-silklurk-target-central-asian-governments","Memory-Resident Backdoors OctLurk & SilkLurk Target Central Asian Governments","2026-07-30T12:20:40.699+00:00",{"slug":37,"title":38,"published_at":39},"goserpent-backdoor-targets-se-asian-governments-in-sophisticated-espionage-campaign","GoSerpent Backdoor Targets SE Asian Governments in Sophisticated Espionage Campaign","2026-07-17T12:22:04.202+00:00",{"slug":41,"title":42,"published_at":43},"goserpent-backdoor-targets-government-entities-with-stealthy-multi-stage-attacks","GoSerpent Backdoor Targets Government Entities with Stealthy Multi-Stage Attacks","2026-07-16T14:23:08.162+00:00",[45,50,55,59,64,69],{"slug":46,"name":47,"problem":48,"stories":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":51,"name":52,"problem":53,"stories":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",3,{"slug":56,"name":57,"problem":58,"stories":54},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":60,"name":61,"problem":62,"stories":63},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",2,{"slug":65,"name":66,"problem":67,"stories":68},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":70,"name":71,"problem":72,"stories":68},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[74,79,85,89,93,97,101,105],{"family":75,"item":76,"code":77,"title":78,"together":49},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":80,"item":81,"code":82,"title":83,"together":84},"cis","13","Control 13","Network Monitoring and Defense",4,{"family":75,"item":86,"code":87,"title":88,"together":84},"au-6","AU-6","Audit Record Review, Analysis, and Reporting",{"family":80,"item":90,"code":91,"title":92,"together":54},"3","Control 3","Data Protection",{"family":75,"item":94,"code":95,"title":96,"together":54},"ac-6","AC-6","Least Privilege",{"family":80,"item":98,"code":99,"title":100,"together":54},"6","Control 6","Access Control Management",{"family":75,"item":102,"code":103,"title":104,"together":54},"ac-2","AC-2","Account Management",{"family":75,"item":106,"code":107,"title":108,"together":54},"si-4","SI-4","System Monitoring"]