MITRE ATT&CKtechnique

T1003 OS Credential Dumping

Published 2017-05-31 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Linux, macOS, Windows
Version
2.2
Created
2017-05-31

Description

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

Related

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (9)

  • M1040 Behavior Prevention on Endpoint mitigation
  • M1041 Encrypt Sensitive Information mitigation
  • M1043 Credential Access Protection mitigation
  • M1015 Active Directory Configuration mitigation
  • M1017 User Training mitigation
  • M1025 Privileged Process Integrity mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation
  • M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · subtechnique of (8)

Referenced by MITRE ATT&CK · uses (20)

  • G1053 Storm-0501 group
  • G1043 BlackByte group
  • S1146 MgBot software (malware)
  • G1003 Ember Bear group
  • G0131 Tonto Team group
  • G0129 Mustang Panda group
  • S0379 Revenge RAT software (malware)
  • G0087 APT39 group
  • G0065 Leviathan group
  • S0232 HOMEFRY software (malware)
  • G0054 Sowbug group
  • G0050 APT32 group
  • G0001 Axiom group
  • G0007 APT28 group
  • G0033 Poseidon Group group
  • G0039 Suckfly group
  • S0030 Carbanak software (malware)
  • S0048 PinchDuke software (malware)
  • S0052 OnionDuke software (malware)
  • S0094 Trojan.Karagany software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-150 Collect Data from Common Resource Locations attack pattern

Referenced by Compliance · mitigates (24)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-3.11 Encrypt Sensitive Data At Rest CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References