tool
gsecdump is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
58th percentile · 58% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
39 distinct rules cover the 2 techniques recorded for this tool. 30 Sigma · 9 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...) | Generic | stable | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2018-09-09 | 2026-06-15 | 78cc2dd2-7d20-4d32-93ff-057084c38b93 | ||||
Splunk | The following analytic detects the assignment of the Privileged Authentication Administrator role to an Azure AD user. (...) | Generic | stable | account_management | - | Microsoft 365 | - | medium | Mauricio Velazco, Gowthamaraj Rajendran, Splunk | 2023-04-25 | 2026-05-13 | a7da845d-6fae-41cf-b823-6c0b8c55814a | |||
Splunk | The following analytic detects the assignment of high-risk Graph API permissions in Azure AD, specifically Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. (...) | Generic | stable | service | - | Microsoft 365 | - | medium | Mauricio Velazco, Splunk | 2024-02-14 | 2026-05-13 | 5521f8c5-1aa3-473c-9eb7-853701924a06 | |||
Files with well-known filenames (sensitive files with credential data) copying | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2019-10-22 | 2024-06-04 | e7be6119-fc37-43f0-ad4f-1f3f99be2f9f | ||||
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID. | Generic | experimental | - | windows | WinEventLog System | - | medium | Jason Mull | 2025-05-12 | — | 882fbe50-d8d7-4e29-ae80-0648a8556866 | ||||
Files with well-known filenames (parts of credential dump software or files produced by them) creati (...) | Generic | test | file_event | windows | Sysmon | - | high | Teymur Kheirkhabarov, oscd.community | 2019-11-01 | 2025-10-25 | 8fbf3271-1ef6-4e94-8210-03c2317947f6 | ||||
Detects well-known credential dumping tools execution via service execution events | Generic | test | service | windows | WinEventLog Security | - | high | Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2017-03-05 | 2022-11-29 | f0d1feba-4344-4ca9-8121-a6c97bd6df52 | ||||
Detects well-known credential dumping tools execution via service execution events | Generic | test | service | windows | WinEventLog System | - | high | Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2017-03-05 | 2022-11-29 | 4976aa50-8f41-45c6-8b15-ab3fc10e79ed | ||||
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. (...) | Generic | test | - | windows | WinEventLog System | - | high | Florian Roth (Nextron Systems) | 2017-05-15 | 2024-01-18 | 39f919f3-980b-4e6f-a975-8af7e507ef2b | ||||
Splunk | The following analytic detects the use of PowerShell commands to copy the SAM, SYSTEM, or SECURITY hives, which are critical for credential theft. (...) | Generic | stable | ps_script | windows | PowerShell | medium | Michael Haag, Splunk | 2021-07-21 | 2026-05-13 | 9251299c-ea5b-11eb-a8de-acde48001122 | ||||
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers | Generic | test | account_management | windows | WinEventLog Security | - | high | Roberto Rodriguez @Cyb3rWard0g | 2019-06-20 | 2022-02-24 | 4ac1f50b-3bd0-4968-902d-868b4647937e | ||||
Detects anyone attempting a backup for the DPAPI Master Key. (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2019-08-10 | 2023-03-15 | 39a94fd1-8c9a-4ff6-bf22-c058762f8014 | ||||
Detects the usage of "reg.exe" in order to dump sensitive registry hives. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113 | 2019-10-22 | 2023-12-13 | fd877b94-9bb5-4191-bb25-d79cbd93c167 | ||||
Splunk | The following analytic detects the use of `esentutl.exe` to access credentials stored in the ntds.dit or SAM file. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-08-18 | 2026-10-02 | d372f928-ce4f-11eb-a762-acde48001122 | |||
Detects the volume shadow copy service initialization and processing via esentutl. (...) | Generic | test | registry_event | windows | Sysmon · WinEventLog Security | - | high | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) | 2020-10-20 | 2022-12-25 | 5aad0995-46ab-41bd-a9ff-724f41114971 | ||||
Detects well-known credential dumping tools execution via specific named pipe creation | Generic | test | pipe_created | windows | Sysmon | - | critical | Teymur Kheirkhabarov, oscd.community | 2019-11-01 | 2023-08-07 | 961d0ba2-3eea-4303-a930-2cf78bbfcc5e | ||||
Detection well-known mimikatz command line arguments | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton | 2019-10-22 | 2023-02-21 | a642964e-bead-4bed-8910-1bb4d63e3b4d | ||||
Detects the usage of "pypykatz" to obtain stored credentials. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-01-05 | 2023-02-05 | a29808fd-ef50-49ff-9c7a-59a9b040b404 | ||||
Detects usage of the Quarks PwDump tool via commandline arguments | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-09-05 | 2023-02-05 | 0685b176-c816-4837-8e7b-1216f346636b | ||||
Detects a dump file written by QuarksPwDump password dumper | Generic | test | file_event | windows | Sysmon | - | critical | Florian Roth (Nextron Systems) | 2018-02-10 | 2024-06-27 | 847def9e-924d-4e90-b7c4-5f581395a2b4 | ||||
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimi (...) | Generic | test | - | windows | - | - | high | Florian Roth (Nextron Systems), David ANDRE (additional keywords) | 2017-01-10 | 2022-01-05 | 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 | ||||
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a (...) | Generic | test | file_event | windows | Sysmon | - | high | Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2022-01-11 | 2022-07-14 | 11b1ed55-154d-4e82-8ad7-83739298f720 | ||||
Splunk | The following analytic detects the assignment of critical Graph API permissions in Azure AD using the O365 Unified Audit Log. (...) | Generic | stable | configuration_change | - | Microsoft 365 | - | medium | Mauricio Velazco, Splunk | 2024-02-14 | 2026-05-13 | 868f3131-d5e1-4bf1-af5b-9b0fbaaaedbb | |||
Detect AD credential dumping using impacket secretdump HKTL | Generic | test | network_connection | windows | WinEventLog Security | - | high | Samir Bousseaden, wagga | 2019-04-03 | 2022-08-11 | 252902e3-5830-4cf6-bf21-c22083dfd5cf | ||||
Detect AD credential dumping using impacket secretdump HKTL. (...) | Generic | test | - | - | SMB · Zeek | - | high | Samir Bousseaden, @neu5ron | 2020-03-19 | 2021-11-27 | 92dae1ed-1c9d-4eff-a567-33acbd95b00e | ||||
Detects the creation of files that look like exports of the local SAM (Security Account Manager) | Generic | test | file_event | windows | Sysmon | high | Florian Roth (Nextron Systems) | 2022-02-11 | 2023-01-05 | 4e87b8e2-2ee9-4b2a-a715-4727d297ece0 | |||||
Detects suspicious PowerShell scripts accessing SAM hives | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2021-07-29 | 2023-01-06 | 1af57a4b-460a-4738-9034-db68b880c665 | ||||
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter. (...) | Generic | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-27 | — | 8a1b2c3d-4e5f-6789-abcd-ef1234567890 | ||||
Splunk | The following analytic detects attempts to access the SAM, SYSTEM, or SECURITY database files within the `windows\system32\config` directory using Windows Security EventCode 4663. (...) | Hunting | stable | file_event | windows | WinEventLog Security | medium | Michael Haag, Mauricio Velazco, Splunk | 2021-07-23 | 2026-05-13 | 57551656-ebdb-11eb-afdf-acde48001122 | ||||
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Ayush Anand (Securityinbits) | 2026-04-28 | — | 2fcda7e2-8c57-4904-86ac-37fc3157e09d | ||||
Shadow Copies creation using operating systems utilities, possible credential access | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2019-10-22 | 2022-11-10 | b17ea6f7-6e90-447e-a799-e6c0a493d6ce | ||||
Transferring files with well-known filenames (sensitive files with credential data) using network sh (...) | Generic | test | network_connection | windows | WinEventLog Security | - | medium | Teymur Kheirkhabarov, oscd.community | 2019-10-22 | 2025-07-11 | 910ab938-668b-401b-b08c-b596e80fdca5 | ||||
Transferring files with well-known filenames (sensitive files with credential data) using network sh (...) | Generic | test | - | - | SMB · Zeek | - | medium | @neu5ron, Teymur Kheirkhabarov, oscd.community | 2020-04-02 | 2021-11-27 | 2e69f167-47b5-4ae7-a390-47764529eff5 | ||||
Detects volume shadow copy mount via Windows event log | Generic | test | - | windows | WinEventLog System | - | low | Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) | 2020-10-20 | 2022-12-25 | f512acbf-e662-4903-843e-97ce4652b740 | ||||
Shadow Copies storage symbolic link creation using operating systems utilities | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov, oscd.community | 2019-10-22 | 2023-03-06 | 40b19fa6-d835-400c-b301-41f3a2baacaf | ||||
Detects the registration of the security event source VSSAudit. (...) | Generic | test | - | windows | WinEventLog Security | - | informational | Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) | 2020-10-20 | 2022-04-28 | e9faba72-4974-4ab2-a4c5-46e25ad59e9b | ||||
Splunk | The following analytic detects modifications to the Windows registry related to the Local Security Authority (LSA) NoLMHash setting. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk | 2024-01-10 | 2026-05-13 | 48cc1605-538c-4223-8382-e36bee5b540d | |||
Splunk | The following analytic detects a source computer authenticating to 30 or more remote endpoints within a 5-minute timespan using Event ID 4624. (...) | Generic | stable | authentication | windows | WinEventLog Security | - | medium | Mauricio Velazco, Splunk | 2023-03-23 | 2026-05-13 | 62606c77-d53d-4182-9371-b02cdbbbcef7 | |||
Splunk | The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive credentials. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk | 2021-05-12 | 2026-10-02 | 5aaff29d-0cce-405b-9ee8-5d06b49d045e |
42nd percentile · 58% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
97th percentile · 97% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 2 Enterprise techniques.
Technique Campaign use over its cumulative rule count.