EXPLORE
← Back to Explore
T1003

OS Credential Dumping

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional se...

LinuxmacOSWindows
106
Detections
3
Sources
13
Threat Actors

BY SOURCE

66elastic32sigma8splunk_escu

PROCEDURES (72)

Service5 detections

Auto-extracted: 5 detections for service

Process Creation Monitoring4 detections

Auto-extracted: 4 detections for process creation monitoring

Dump4 detections

Auto-extracted: 4 detections for dump

Mimikatz3 detections

Auto-extracted: 3 detections for mimikatz

Lsass3 detections

Auto-extracted: 3 detections for lsass

Ntds3 detections

Auto-extracted: 3 detections for ntds

Lsass3 detections

Auto-extracted: 3 detections for lsass

Service3 detections

Auto-extracted: 3 detections for service

Exfiltrat2 detections

Auto-extracted: 2 detections for exfiltrat

General Monitoring2 detections

Auto-extracted: 2 detections for general monitoring

Privilege2 detections

Auto-extracted: 2 detections for privilege

Powershell2 detections

Auto-extracted: 2 detections for powershell

Dump2 detections

Auto-extracted: 2 detections for dump

Dcsync2 detections

Auto-extracted: 2 detections for dcsync

Encrypt2 detections

Auto-extracted: 2 detections for encrypt

Ransomware2 detections

Auto-extracted: 2 detections for ransomware

Lateral2 detections

Auto-extracted: 2 detections for lateral

Registry2 detections

Auto-extracted: 2 detections for registry

Shadow Cop2 detections

Auto-extracted: 2 detections for shadow cop

Registry2 detections

Auto-extracted: 2 detections for registry

Credential2 detections

Auto-extracted: 2 detections for credential

Dump2 detections

Auto-extracted: 2 detections for dump

Bypass1 detections

Auto-extracted: 1 detections for bypass

Dump1 detections

Auto-extracted: 1 detections for dump

Mimikatz1 detections

Auto-extracted: 1 detections for mimikatz

Bypass1 detections

Auto-extracted: 1 detections for bypass

Remote1 detections

Auto-extracted: 1 detections for remote

Credential1 detections

Auto-extracted: 1 detections for credential

Lateral1 detections

Auto-extracted: 1 detections for lateral

Persist1 detections

Auto-extracted: 1 detections for persist

Inject1 detections

Auto-extracted: 1 detections for inject

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Script Block1 detections

Auto-extracted: 1 detections for script block

Api1 detections

Auto-extracted: 1 detections for api

Token1 detections

Auto-extracted: 1 detections for token

Ransomware1 detections

Auto-extracted: 1 detections for ransomware

Azure1 detections

Auto-extracted: 1 detections for azure

Inject1 detections

Auto-extracted: 1 detections for inject

Aws1 detections

Auto-extracted: 1 detections for aws

Encrypt1 detections

Auto-extracted: 1 detections for encrypt

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Privilege1 detections

Auto-extracted: 1 detections for privilege

Azure1 detections

Auto-extracted: 1 detections for azure

Unusual1 detections

Auto-extracted: 1 detections for unusual

Remote1 detections

Auto-extracted: 1 detections for remote

Inject1 detections

Auto-extracted: 1 detections for inject

Lateral1 detections

Auto-extracted: 1 detections for lateral

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Api1 detections

Auto-extracted: 1 detections for api

Remote1 detections

Auto-extracted: 1 detections for remote

Script Block1 detections

Auto-extracted: 1 detections for script block

File Monitoring1 detections

Auto-extracted: 1 detections for file monitoring

Token1 detections

Auto-extracted: 1 detections for token

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Remote1 detections

Auto-extracted: 1 detections for remote

Api1 detections

Auto-extracted: 1 detections for api

Inject1 detections

Auto-extracted: 1 detections for inject

Lateral1 detections

Auto-extracted: 1 detections for lateral

Lateral1 detections

Auto-extracted: 1 detections for lateral

Ntds1 detections

Auto-extracted: 1 detections for ntds

Dump1 detections

Auto-extracted: 1 detections for dump

Command Line Monitoring1 detections

Auto-extracted: 1 detections for command line monitoring

Kerbero1 detections

Auto-extracted: 1 detections for kerbero

Kerbero1 detections

Auto-extracted: 1 detections for kerbero

Service1 detections

Auto-extracted: 1 detections for service

Mimikatz1 detections

Auto-extracted: 1 detections for mimikatz

Service1 detections

Auto-extracted: 1 detections for service

Aws1 detections

Auto-extracted: 1 detections for aws

Unusual1 detections

Auto-extracted: 1 detections for unusual

Dcsync1 detections

Auto-extracted: 1 detections for dcsync

Bypass1 detections

Auto-extracted: 1 detections for bypass

DETECTIONS (106)

Access to a Sensitive LDAP Attribute
elasticmedium
Access To Crypto Currency Wallets By Uncommon Applications
sigmamedium
Antivirus Password Dumper Detection
sigmacritical
Attacker Tools On Endpoint
splunk_escu
Capture Credentials with Rpcping.exe
sigmamedium
Cisco Secure Firewall - High Priority Intrusion Classification
splunk_escu
Creation or Modification of Domain Backup DPAPI private key
elastichigh
Credential Access via TruffleHog Execution
elasticmedium
Credential Acquisition via Registry Hive Dumping
elastichigh
Credential Dumping - Detected - Elastic Endgame
elastichigh
Credential Dumping - Prevented - Elastic Endgame
elasticmedium
Credential Manager Access By Uncommon Applications
sigmamedium
Detect Mimikatz With PowerShell Script Block Logging
splunk_escu
Disabling Lsa Protection via Registry Modification
elastichigh
Dumping Account Hashes via Built-In Commands
elastichigh
Enable WDigest UseLogonCredential Registry
splunk_escu
Esentutl Gather Credentials
sigmamedium
File Access Of Signal Desktop Sensitive Data
sigmamedium
FirstTime Seen Account Performing DCSync
elastichigh
Full User-Mode Dumps Enabled System-Wide
elasticmedium
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
sigmahigh
HackTool - Rubeus Execution
sigmacritical
HackTool - Rubeus Execution - ScriptBlock
sigmahigh
Hacktool Execution - Imphash
sigmacritical
Hacktool Execution - PE Metadata
sigmahigh
Interesting Service Enumeration Via Sc.EXE
sigmalow
Kerberos Cached Credentials Dumping
elastichigh
Kirbi File Creation
elastichigh
Linux init (PID 1) Secret Dump via GDB
elastichigh
Linux Keylogging with Pam.d
sigmahigh
Linux Process Hooking via GDB
elasticlow
Live Memory Dump Using Powershell
sigmahigh
Loaded Module Enumeration Via Tasklist.EXE
sigmamedium
LSASS Memory Dump Creation
elastichigh
LSASS Memory Dump Handle Access
elasticmedium
LSASS Process Access via Windows API
elasticmedium
Manual Memory Dumping via Proc Filesystem
elastichigh
Microsoft IIS Connection Strings Decryption
elastichigh
Microsoft IIS Connection Strings Decryption
sigmahigh
Microsoft IIS Service Account Password Dumped
sigmahigh
Mimikatz Memssp Log File Detected
elastichigh
Modification of WDigest Security Provider
elastichigh
Multiple Vault Web Credentials Read
elasticmedium
NTDS Dump via Wbadmin
elasticmedium
NTDS or SAM Database File Copied
elastichigh
OpenCanary - MSSQL Login Attempt Via SQLAuth
sigmahigh
OpenCanary - MSSQL Login Attempt Via Windows Authentication
sigmahigh
OpenCanary - MySQL Login Attempt
sigmahigh
OpenCanary - REDIS Action Command Attempt
sigmahigh
PetitPotam Suspicious Kerberos TGT Request
splunk_escu
Potential Active Directory Replication Account Backdoor
elasticmedium
Potential Credential Access via DCSync
elasticmedium
Potential Credential Access via DuplicateHandle in LSASS
elasticmedium
Potential Credential Access via LSASS Memory Dump
elastichigh
Potential Credential Access via Renamed COM+ Services DLL
elastichigh
Potential Credential Access via Trusted Developer Utility
elastichigh
Potential Credential Access via Windows Utilities
elastichigh
Potential Credential Dumping Attempt Using New NetworkProvider - CLI
sigmahigh
Potential Credential Dumping Attempt Using New NetworkProvider - REG
sigmamedium
Potential Credential Dumping Via LSASS Process Clone
sigmacritical
Potential Invoke-Mimikatz PowerShell Script
elasticcritical
Potential Invoke-Mimikatz PowerShell Script
sigmahigh
Potential Linux Credential Dumping via Proc Filesystem
elastichigh
Potential Linux Credential Dumping via Unshadow
elastichigh
Potential LSASS Clone Creation via PssCaptureSnapShot
elastichigh
Potential LSASS Memory Dump via PssCaptureSnapShot
elastichigh
Potential PowerShell HackTool Script by Function Names
elasticmedium
Potential Privilege Escalation via Linux DAC permissions
elasticlow
Potential Remote Credential Access via Registry
elastichigh
Potential Secret Scanning via Gitleaks
elasticmedium
Potential Shadow File Read via Command Line Utilities
elasticmedium
Potential Suspicious File Edit
elasticlow
Potential Unauthorized Access via Wildcard Injection Detected
elasticmedium
Potential Veeam Credential Access Command
elasticmedium
Potentially Suspicious ODBC Driver Registered
sigmahigh
PowerShell Invoke-NinjaCopy script
elastichigh
PowerShell Kerberos Ticket Dump
elastichigh
PowerShell Kerberos Ticket Request
elastichigh
PowerShell MiniDump Script
elastichigh
PowerShell Script with Veeam Credential Access Capabilities
elasticmedium
PUA - AWS TruffleHog Execution
sigmamedium
Rare Subscription-level Operations In Azure
sigmamedium
Searching for Saved Credentials via VaultCmd
elasticmedium
Sensitive Registry Hive Access via RegBack
elastichigh
Shadow Copies Creation Using Operating Systems Utilities
sigmamedium
Suspicious /proc/maps Discovery
elastichigh
Suspicious Execution from Foomatic-rip or Cupsd Parent
elastichigh
Suspicious Execution via Windows Subsystem for Linux
elasticlow
Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
sigmahigh
Suspicious LSASS Access via MalSecLogon
elastichigh
Suspicious Lsass Process Access
elasticmedium
Suspicious Module Loaded by LSASS
elasticmedium
Suspicious Remote Registry Access via SeBackupPrivilege
elasticmedium
Suspicious Symbolic Link Created
elasticlow
Suspicious SYSTEM User Process Creation
sigmahigh
Symbolic Link to Shadow Copy Created
elasticmedium
Untrusted DLL Loaded by Azure AD Sync Service
elastichigh
Unusual Web Config File Access
elastichigh
Veeam Backup Library Loaded by Unusual Process
elasticmedium
WCE wceaux.dll Access
sigmacritical
Web Server Potential Command Injection Request
elasticlow
Windows Mimikatz Binary Execution
splunk_escu
Windows Post Exploitation Risk Behavior
splunk_escu
Windows Registry File Creation in SMB Share
elasticmedium
Windows Remote Access Software BRC4 Loaded Dll
splunk_escu
Wireless Credential Dumping using Netsh Command
elastichigh