T1003
OS Credential Dumping
Linux · macOS · Windows13 pieces on this siteT1003 on attack.mitre.org
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers.
If this is happening now
Checklists and playbooks to open while the alert is still live.
First 15 minutes: an account was added to Domain Admins
A tier-zero group changed and nobody has a ticket for it. Whoever made the change is at least as compromised as the account they added. How to confirm, contain and scope without handing the operator another credential.
First 15 minutes: an LSASS credential dump alert on a server
A process that is not a security product has read LSASS memory. What to do before the playbook opens, in the order that protects the evidence and stops you adding your own credentials to the pile.
Domain-level access you cannot account for
An unexplained Domain Admin, directory replication by something that is not a domain controller, or a ticket that does not match any authentication.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma endpoint pack: seven rules for the Windows techniques that keep working
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
YARA triage samples: five heuristic rules for a web root, a script directory or a triage collection
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
Hunt: rundll32 calling the comsvcs MiniDump export
Finds LSASS dumps taken with a DLL that ships in System32, whether the export is named or called by ordinal. One idea in three query languages, each bounded to seven days.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Sysmon operational log
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: the credential dump that used nothing but Windows
An LSASS dump taken with a DLL that ships in System32, called by ordinal so the obvious rule misses it. Work out which process touched LSASS, which access mask matters, and whose credentials you now have to assume are gone.
Guided lab: nine hours at Northwind Freight, from lure to scheduled task
A constructed intrusion written as a DFIR report. You get the same artifacts an analyst gets on day one, in the order they arrive, and you build the timeline yourself. The company is fictional; the techniques, event IDs and analytic reasoning are not.
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
Read
Analyses, case studies, guides, references and interview questions.
False-Positive Hall of Fame No. 1: six alerts that were the software working
Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.
Incident report: Kesterline Components, 8 May 2026
A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.
Memory forensics cheat sheet: acquisition order and the Volatility 3 plugins that answer real questions
What to capture before you touch anything else, how to check the image is usable, and the Volatility 3 plugins grouped by the question they answer, with what each one cannot tell you.
how MITRE says to see it
Credential Dumping via Sensitive Memory and Registry Access Correlation
- Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.
- Processes opening /proc/*/mem or /proc/*/maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.
- Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.
what reduces it
- M1041 Encrypt Sensitive Information. Ensure Domain Controller backups are properly secured.
- M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.
- M1027 Password Policies. Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
- M1017 User Training. Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
- M1026 Privileged Account Management. Windows: Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
- M1025 Privileged Process Integrity. On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.