{"id":"T1003","name":"OS Credential Dumping","url":"https://attack.mitre.org/techniques/T1003","tactics":["credential-access"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0234","stix_id":"x-mitre-detection-strategy--8b8cfd0f-bbe2-417b-b1d2-eebf84d3f008","name":"Credential Dumping via Sensitive Memory and Registry Access Correlation","url":"https://attack.mitre.org/detectionstrategies/DET0234","analytics":[{"id":"AN0648","stix_id":"x-mitre-analytic--5a5d5ff5-e2bb-4ba9-9f95-504c86b1a1cf","name":"Analytic 0648","description":"Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.","url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0648","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4662","data_component":"DC0071","data_component_name":"Active Directory Object Access","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"AccessMask","description":"Set to detect full access rights (0x1F0FFF) or modify based on tool behavior."},{"field":"TimeWindow","description":"Define how soon access to LSASS is followed by suspicious file or registry activity."},{"field":"ParentProcessFilter","description":"Allowlist known security tools or system processes accessing LSASS."}],"live":true,"detection_strategies":["DET0234"],"techniques":["T1003"]},{"id":"AN0649","stix_id":"x-mitre-analytic--82cdec5a-52af-4489-b002-b0256e5ba60e","name":"Analytic 0649","description":"Processes opening /proc/*/mem or /proc/*/maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.","url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0649","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"ptrace","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"TargetProcessName","description":"Define sensitive targets (e.g., sshd, login) being memory-read."},{"field":"ToolProcessName","description":"Flag use of memory dump tools like gcore, gdb, pmap."}],"live":true,"detection_strategies":["DET0234"],"techniques":["T1003"]},{"id":"AN0650","stix_id":"x-mitre-analytic--29370f2b-0877-458c-8ade-a9a23b8fb7b2","name":"Analytic 0650","description":"Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.","url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0650","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Code Execution & Entitlement Access","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"macos-unifiedlog"},{"name":"macos:keychain","channel":"Access to Keychain DB or system.keychain","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-keychain"},{"name":"macos:osquery","channel":"Invocation of osascript or dylib injection","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"KeychainAccessPath","description":"Path to watch for abnormal access, e.g., /Library/Keychains/"},{"field":"SignedBinaryStatus","description":"Filter out signed/trusted binaries."}],"live":true,"detection_strategies":["DET0234"],"techniques":["T1003"]}],"live":true,"version":"1.0","techniques":["T1003"]}],"sigma_rules":[{"id":"0442defa-b4a2-41c9-ae2c-ea7042fc4701","title":"Potential Credential Dumping Attempt Using New NetworkProvider - REG","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-23","modified":"2023-08-17","description":"Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it","references":["https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade","https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.credential-access","attack.t1003"],"path":"rules/windows/registry/registry_set/registry_set_new_network_provider.yml","techniques":["T1003"],"cves":[]},{"id":"189e3b02-82b2-4b90-9662-411eb64486d4","title":"Potential Invoke-Mimikatz PowerShell Script","author":"Tim Rauch, Elastic (idea)","status":"test","level":"high","date":"2022-09-28","modified":null,"description":"Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.","references":["https://www.elastic.co/guide/en/security/current/potential-invoke-mimikatz-powershell-script.html#potential-invoke-mimikatz-powershell-script"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1003"],"path":"rules/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml","techniques":["T1003"],"cves":[]},{"id":"1de68c67-af5c-4097-9c85-fe5578e09e67","title":"WCE wceaux.dll Access","author":"Thomas Patzke","status":"test","level":"critical","date":"2017-06-14","modified":"2025-01-30","description":"Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host","references":["https://www.jpcert.or.jp/english/pub/sr/ir_research.html","https://jpcertcc.github.io/ToolAnalysisResultSheet"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1003","attack.s0005"],"path":"rules/windows/builtin/security/win_security_mal_wceaux_dll.yml","techniques":["T1003"],"cves":[]},{"id":"24e3e58a-646b-4b50-adef-02ef935b9fc8","title":"Hacktool Execution - Imphash","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2022-03-04","modified":"2024-11-23","description":"Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.resource-development","attack.t1588.002","attack.t1003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_execution_via_imphashes.yml","techniques":["T1588.002","T1003"],"cves":[]},{"id":"2617e7ed-adb7-40ba-b0f3-8f9945fe6c09","title":"Suspicious SYSTEM User Process Creation","author":"Florian Roth (Nextron Systems), David ANDRE (additional keywords)","status":"test","level":"high","date":"2021-12-20","modified":"2025-10-19","description":"Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)","references":["Internal Research","https://tools.thehacker.recipes/mimikatz/modules"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.privilege-escalation","attack.stealth","attack.t1134","attack.t1003","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml","techniques":["T1134","T1003","T1027"],"cves":[]},{"id":"2d3cdeec-c0db-45b4-aa86-082f7eb75701","title":"Microsoft IIS Service Account Password Dumped","author":"Tim Rauch, Janantha Marasinghe, Elastic (original idea)","status":"test","level":"high","date":"2022-11-08","modified":"2023-01-22","description":"Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords","references":["https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html","https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA","https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003"],"path":"rules/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml","techniques":["T1003"],"cves":[]},{"id":"3245cd30-e015-40ff-a31d-5cadd5f377ec","title":"HackTool - Rubeus Execution - ScriptBlock","author":"Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-04-27","modified":null,"description":"Detects the execution of the hacktool Rubeus using specific command line flags","references":["https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus","https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html","https://github.com/GhostPack/Rubeus"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1003","attack.t1558.003","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml","techniques":["T1003","T1558.003","T1550.003"],"cves":[]},{"id":"33b3cfb1-574e-44b9-b527-fbf9303b9d7b","title":"Potential Exploitation of CVE-2025-5054 or CVE-2025-4598","author":"Milad Cheraghi","status":"experimental","level":"medium","date":"2026-04-28","modified":null,"description":"Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.\nEnabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.\nThese dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.\nCVE-2025-5054: Information leak via core dumps from SUID binaries using apport.\nCVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.\n","references":["https://nvd.nist.gov/vuln/detail/CVE-2025-5054","https://nvd.nist.gov/vuln/detail/CVE-2025-4598","https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.privilege-escalation","attack.credential-access","attack.t1548","attack.t1003","cve.2025-5054","cve.2025-4598","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE_2025_4598/proc_creation_lnx_exploit_cve_2025_5054_or_cve_2025_4598.yml","techniques":["T1548","T1003"],"cves":["CVE-2025-5054","CVE-2025-4598"]},{"id":"34275eb8-fa19-436b-b959-3d9ecd53fa1f","title":"Loaded Module Enumeration Via Tasklist.EXE","author":"Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2024-02-12","modified":"2024-03-13","description":"Detects the enumeration of a specific DLL or EXE being used by a binary via \"tasklist.exe\".\nThis is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.\nIn order to dump the process memory or perform other nefarious actions.\n","references":["https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/","https://pentestlab.blog/tag/svchost/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.t1003","attack.credential-access"],"path":"rules/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml","techniques":["T1003"],"cves":[]},{"id":"37c1333a-a0db-48be-b64b-7393b2386e3b","title":"Hacktool Execution - PE Metadata","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-27","modified":"2024-01-15","description":"Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed","references":["https://github.com/cube0x0","https://www.virustotal.com/gui/search/metadata%253ACube0x0/files"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.resource-development","attack.t1588.002","attack.t1003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml","techniques":["T1588.002","T1003"],"cves":[]},{"id":"3ec9a16d-0b4f-4967-9542-ebf38ceac7dd","title":"OpenCanary - MSSQL Login Attempt Via SQLAuth","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.\n","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.credential-access","attack.collection","attack.t1003","attack.t1213"],"path":"rules/application/opencanary/opencanary_mssql_login_sqlauth.yml","techniques":["T1003","T1213"],"cves":[]},{"id":"407aecb1-e762-4acf-8c7b-d087bcff3bb6","title":"Credential Manager Access By Uncommon Applications","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-10-11","modified":"2026-07-28","description":"Detects suspicious processes based on name and location that access the windows credential manager and vault.\nWhich can be a sign of credential stealing. Example case would be usage of mimikatz \"dpapi::cred\" function\n","references":["https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz","https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.t1003","attack.credential-access"],"path":"rules/windows/file/file_access/file_access_win_susp_credential_manager_access.yml","techniques":["T1003"],"cves":[]},{"id":"416bc4a2-7217-4519-8dc7-c3271817f1d5","title":"Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-27","modified":"2026-01-09","description":"Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.\nThese DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.\n","references":["https://blog.axelarator.net/hunting-for-edr-freeze/","https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html","https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.credential-access","attack.defense-impairment","attack.t1003","attack.t1685"],"path":"rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml","techniques":["T1003","T1685"],"cves":[]},{"id":"49aae26c-450e-448b-911d-b3c13d178dfc","title":"Linux Keylogging with Pam.d","author":"Pawel Mazur","status":"test","level":"high","date":"2021-05-24","modified":"2022-12-18","description":"Detect attempt to enable auditing of TTY input","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md","https://linux.die.net/man/8/pam_tty_audit","https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing","https://access.redhat.com/articles/4409591#audit-record-types-2"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.collection","attack.credential-access","attack.t1003","attack.t1056.001"],"path":"rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml","techniques":["T1003","T1056.001"],"cves":[]},{"id":"547dfc53-ebf6-4afe-8d2e-793d9574975d","title":"OpenCanary - REDIS Action Command Attempt","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.credential-access","attack.collection","attack.t1003","attack.t1213"],"path":"rules/application/opencanary/opencanary_redis_command.yml","techniques":["T1003","T1213"],"cves":[]},{"id":"5d6c375a-18ae-4952-b4f6-8b803f6c8555","title":"File Access Of Signal Desktop Sensitive Data","author":"Andreas Braathen (mnemonic.io)","status":"experimental","level":"medium","date":"2025-10-19","modified":null,"description":"Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json.\nThe db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.\nSince the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.\nCurrently the rule only covers the default Signal installation path in AppData\\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.\n","references":["https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/","https://vmois.dev/query-signal-desktop-messages-sqlite/"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1003"],"path":"rules/windows/builtin/security/win_security_signal_sensitive_config_access.yml","techniques":["T1003"],"cves":[]},{"id":"6e2a900a-ced9-4e4a-a9c2-13e706f9518a","title":"HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump","author":"SecurityAura","status":"test","level":"high","date":"2022-11-16","modified":"2024-06-27","description":"Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.","references":["https://github.com/Porchetta-Industries/CrackMapExec","https://github.com/fortra/impacket/blob/ff8c200fd040b04d3b5ff05449646737f836235d/examples/secretsdump.py"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1003"],"path":"rules/windows/file/file_event/file_event_win_hktl_remote_cred_dump.yml","techniques":["T1003"],"cves":[]},{"id":"6e78f90f-0043-4a01-ac41-f97681613a66","title":"OpenCanary - MSSQL Login Attempt Via Windows Authentication","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.\n","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.credential-access","attack.collection","attack.t1003","attack.t1213"],"path":"rules/application/opencanary/opencanary_mssql_login_winauth.yml","techniques":["T1003","T1213"],"cves":[]},{"id":"78cc2dd2-7d20-4d32-93ff-057084c38b93","title":"Antivirus - Password Dumper Signature","author":"Florian Roth (Nextron Systems), Arnim Rupp","status":"stable","level":"critical","date":"2018-09-09","modified":"2026-06-15","description":"Detects a highly relevant Antivirus alert that reports password dumpers and stealers.\nThis event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.\n","references":["https://www.nextron-systems.com/?s=antivirus","https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619","https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448"],"logsource":{"category":"antivirus"},"tags":["attack.credential-access","attack.t1003","attack.t1558","attack.t1003.001","attack.t1003.002"],"path":"rules/category/antivirus/av_password_dumper.yml","techniques":["T1003","T1558","T1003.001","T1003.002"],"cves":[]},{"id":"7df1713a-1a5b-4a4b-a071-dc83b144a101","title":"Esentutl Gather Credentials","author":"sam0x90","status":"test","level":"medium","date":"2021-08-06","modified":"2022-10-09","description":"Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.","references":["https://twitter.com/vxunderground/status/1423336151860002816","https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003","attack.t1003.003","attack.s0404"],"path":"rules/windows/process_creation/proc_creation_win_esentutl_params.yml","techniques":["T1003","T1003.003"],"cves":[]},{"id":"7ec2c172-dceb-4c10-92c9-87c1881b7e18","title":"HackTool - Rubeus Execution","author":"Florian Roth (Nextron Systems)","status":"stable","level":"critical","date":"2018-12-19","modified":"2023-04-20","description":"Detects the execution of the hacktool Rubeus via PE information of command line parameters","references":["https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus","https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html","https://github.com/GhostPack/Rubeus"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003","attack.t1558.003","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_rubeus.yml","techniques":["T1003","T1558.003","T1550.003"],"cves":[]},{"id":"8a1b2c3d-4e5f-6789-abcd-ef1234567890","title":"PUA - Memory Dump Mount Via MemProcFS","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-04-27","modified":null,"description":"Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.\nMemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.\nThreat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.\nMemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.\n","references":["https://github.com/ufrisk/MemProcFS","https://0xdf.gitlab.io/2024/10/05/htb-freelancer.html#","https://www.huntress.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003","attack.t1003.001","attack.t1003.004","attack.t1003.002"],"path":"rules/windows/process_creation/proc_creation_win_pua_memprocfs.yml","techniques":["T1003","T1003.001","T1003.004","T1003.002"],"cves":[]},{"id":"91cb43db-302a-47e3-b3c8-7ede481e27bf","title":"Access To Browser Credential Files By Uncommon Applications","author":"frack113, X__Junior (Nextron Systems)","status":"test","level":"low","date":"2022-04-09","modified":"2024-07-29","description":"Detects file access requests to browser credential stores by uncommon processes.\nCould indicate potential attempt of credential stealing.\nRequires heavy baselining before usage\n","references":["https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users","https://github.com/lclevy/firepwd"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.t1003","attack.credential-access","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_access/file_access_win_browsers_credential.yml","techniques":["T1003"],"cves":[]},{"id":"93671f99-04eb-4ab4-a161-70d446a84003","title":"Capture Credentials with Rpcping.exe","author":"Julia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2025-10-31","description":"Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.","references":["https://lolbas-project.github.io/lolbas/Binaries/Rpcping/","https://twitter.com/vysecurity/status/974806438316072960","https://twitter.com/vysecurity/status/873181705024266241","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875578(v=ws.11)"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003"],"path":"rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml","techniques":["T1003"],"cves":[]},{"id":"97dbf6e2-e436-44d8-abee-4261b24d3e41","title":"Microsoft IIS Connection Strings Decryption","author":"Tim Rauch, Elastic (idea)","status":"test","level":"high","date":"2022-09-28","modified":"2022-12-30","description":"Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.","references":["https://www.elastic.co/guide/en/security/current/microsoft-iis-connection-strings-decryption.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003"],"path":"rules/windows/process_creation/proc_creation_win_iis_connection_strings_decryption.yml","techniques":["T1003"],"cves":[]},{"id":"a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73","title":"Registry Hive File Staged Outside Standard User Profile Path","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-23","modified":null,"description":"Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.\nThese files generally contain various user-specific registry settings and are typically located in the user's profile directory.\nStaging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings\nfor persistence, privilege escalation, or dump user registry hives for credential harvesting.\n","references":["https://github.com/MSNightmare/LegacyHive","https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.t1548","attack.credential-access","attack.t1003"],"path":"rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation.yml","techniques":["T1548","T1003"],"cves":[]},{"id":"a840e606-7c8c-4684-9bc1-eb6b6155127f","title":"PUA - AWS TruffleHog Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-10-21","modified":null,"description":"Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.\nIt has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.\n","references":["https://github.com/trufflesecurity/trufflehog","https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.credential-access","attack.t1555","attack.t1003"],"path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_pua_trufflehog.yml","techniques":["T1555","T1003"],"cves":[]},{"id":"b17ea6f7-6e90-447e-a799-e6c0a493d6ce","title":"Shadow Copies Creation Using Operating Systems Utilities","author":"Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community","status":"test","level":"medium","date":"2019-10-22","modified":"2022-11-10","description":"Shadow Copies creation using operating systems utilities, possible credential access","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003","attack.t1003.002","attack.t1003.003"],"path":"rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml","techniques":["T1003","T1003.002","T1003.003"],"cves":[]},{"id":"baef1ec6-2ca9-47a3-97cc-4cf2bda10b77","title":"Potential Credential Dumping Attempt Using New NetworkProvider - CLI","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-23","modified":"2023-02-02","description":"Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it","references":["https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade","https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003"],"path":"rules/windows/process_creation/proc_creation_win_registry_new_network_provider.yml","techniques":["T1003"],"cves":[]},{"id":"c1182e02-49a3-481c-b3de-0fadc4091488","title":"Rare Subscription-level Operations In Azure","author":"sawwinnnaung","status":"test","level":"medium","date":"2020-05-07","modified":"2023-10-11","description":"Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.","references":["https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.t1003","attack.credential-access"],"path":"rules/cloud/azure/activity_logs/azure_rare_operations.yml","techniques":["T1003"],"cves":[]},{"id":"c5f37810-a85f-4186-81e9-33f23abb4141","title":"Access To Chromium Browsers Sensitive Files By Uncommon Applications","author":"X__Junior (Nextron Systems)","status":"test","level":"low","date":"2024-07-29","modified":null,"description":"Detects file access requests to chromium based browser sensitive files by uncommon processes.\nCould indicate potential attempt of stealing sensitive information.\n","references":["Internal Research"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.t1003","attack.credential-access","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_access/file_access_win_browsers_chromium_sensitive_files.yml","techniques":["T1003"],"cves":[]},{"id":"c8da0dfd-4ed0-4b68-962d-13c9c884384e","title":"Potential Credential Dumping Via LSASS Process Clone","author":"Florian Roth (Nextron Systems), Samir Bousseaden","status":"test","level":"critical","date":"2021-11-27","modified":"2023-03-02","description":"Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity","references":["https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/","https://twitter.com/Hexacorn/status/1420053502554951689","https://twitter.com/SBousseaden/status/1464566846594691073?s=20"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003","attack.t1003.001"],"path":"rules/windows/process_creation/proc_creation_win_lsass_process_clone.yml","techniques":["T1003","T1003.001"],"cves":[]},{"id":"cd185561-4760-45d6-a63e-a51325112cae","title":"Live Memory Dump Using Powershell","author":"Max Altgelt (Nextron Systems)","status":"test","level":"high","date":"2021-09-21","modified":"2022-12-25","description":"Detects usage of a PowerShell command to dump the live memory of a Windows machine","references":["https://learn.microsoft.com/en-us/powershell/module/storage/get-storagediagnosticinfo?view=windowsserver2022-ps"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1003"],"path":"rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml","techniques":["T1003"],"cves":[]},{"id":"e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4","title":"Potentially Suspicious ODBC Driver Registered","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-23","modified":"2023-08-17","description":"Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location","references":["https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.credential-access","attack.persistence","attack.t1003"],"path":"rules/windows/registry/registry_set/registry_set_odbc_driver_registered_susp.yml","techniques":["T1003"],"cves":[]},{"id":"e7d79a1b-25ed-4956-bd56-bd344fa8fd06","title":"OpenCanary - MySQL Login Attempt","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where a MySQL service on an OpenCanary node has had a login attempt.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.credential-access","attack.collection","attack.t1003","attack.t1213"],"path":"rules/application/opencanary/opencanary_mysql_login_attempt.yml","techniques":["T1003","T1213"],"cves":[]},{"id":"e83e8899-c9b2-483b-b355-5decc942b959","title":"Interesting Service Enumeration Via Sc.EXE","author":"Swachchhanda Shrawan Poudel","status":"test","level":"low","date":"2024-02-12","modified":null,"description":"Detects the enumeration and query of interesting and in some cases sensitive services on the system via \"sc.exe\".\nAttackers often try to enumerate the services currently running on a system in order to find different attack vectors.\n","references":["https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/","https://pentestlab.blog/tag/svchost/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.t1003","attack.credential-access"],"path":"rules/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml","techniques":["T1003"],"cves":[]},{"id":"f41b0311-44f9-44f0-816d-dd45e39d4bc8","title":"Access To Crypto Currency Wallets By Uncommon Applications","author":"X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2024-07-29","modified":null,"description":"Detects file access requests to crypto currency files by uncommon processes.\nCould indicate potential attempt of crypto currency wallet stealing.\n","references":["Internal Research"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.t1003","attack.credential-access"],"path":"rules/windows/file/file_access/file_access_win_susp_crypto_currency_wallets.yml","techniques":["T1003"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-32756","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-32709","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-48248","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-57727","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-21335","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-21334","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-21333","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-0282","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-4577","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-28252","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-44515","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-13608","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-11634","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-5902","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-0604","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-22893","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}