T1003 · OS Credential Dumping

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1003 · OS Credential Dumping · Sunturai

attack-patternenterprise-attackT1003

OS Credential Dumping

attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

Created: May 31, 2017, 9:30 PM UTC
Modified: Oct 24, 2025, 5:48 PM UTC

8 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

157 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Enable WDigest UseLogonCredential Registry	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Suspicious Execution via Windows Subsystem for Linux	Low	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Access to a Sensitive LDAP Attribute	Medium	Elastic detection rules	Oct 7, 2026	Elastic License 2.0
Potential Credential Access via DCSync	Medium	Elastic detection rules	Oct 7, 2026	Elastic License 2.0
Attacker Tools On Endpoint	Medium	Splunk security content	Oct 6, 2026	Apache License 2.0
Suspicious Lsass Process Access	Medium	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
LSASS Process Access via Windows API	Medium	Elastic detection rules	Sep 23, 2026	Elastic License 2.0
Potential PowerShell HackTool Script by Function Names	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Disabling Lsa Protection via Registry Modification	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Wireless Credential Dumping using Netsh Command	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
NTDS Dump via Wbadmin	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential LSASS Clone Creation via PssCaptureSnapShot	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Veeam Credential Access Command	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Veeam Backup Library Loaded by Unusual Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Symbolic Link to Shadow Copy Created	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Remote Registry Access via SeBackupPrivilege	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential LSASS Memory Dump via PssCaptureSnapShot	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Credential Access via LSASS Memory Dump	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Credential Access via Renamed COM+ Services DLL	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Searching for Saved Credentials via VaultCmd	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Multiple Vault Web Credentials Read	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Remote Credential Access via Registry	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sensitive Registry Hive Access via RegBack	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Credential Access via DuplicateHandle in LSASS	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PowerShell Script with Veeam Credential Access Capabilities	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0