Techniques › T1003
T1003 OS Credential Dumping
credential access — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
37
Sigma rules tagged attack.t1003
18
KEV CVEs mapped here
<p>Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.</p><p>Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-32756 | Fortinet Multiple Products | secondary impact | Mapped | 2025-05-14 |
| CVE-2025-32709 | Microsoft Windows | primary impact | Mapped | 2025-05-13 |
| CVE-2024-48248 | NAKIVO Backup and Replication | secondary impact | Mapped | 2025-03-19 |
| CVE-2024-57727 | SimpleHelp SimpleHelp | primary impact | Mapped | 2025-02-13 |
| CVE-2025-21335 | Microsoft Windows | primary impact | Mapped | 2025-01-14 |
| CVE-2025-21334 | Microsoft Windows | primary impact | Mapped | 2025-01-14 |
| CVE-2025-21333 | Microsoft Windows | primary impact | Mapped | 2025-01-14 |
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | primary impact | Mapped | 2025-01-08 |
| CVE-2024-4577 | PHP Group PHP | secondary impact | Mapped | 2024-06-12 |
| CVE-2023-28252 | Microsoft Windows | secondary impact | Mapped | 2023-04-11 |
| CVE-2021-44515 | Zoho Desktop Central | secondary impact | Mapped | 2021-12-10 |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | secondary impact | Mapped | 2021-12-01 |
| CVE-2019-13608 | Citrix StoreFront Server | secondary impact | Mapped | 2021-11-03 |
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows | secondary impact | Mapped | 2021-11-03 |
| CVE-2020-5902 | F5 BIG-IP | secondary impact | Stale | 2021-11-03 |
| CVE-2019-0604 | Microsoft SharePoint | secondary impact | Mapped | 2021-11-03 |
| CVE-2021-22893 | Ivanti Pulse Connect Secure | secondary impact | Mapped | 2021-11-03 |
| CVE-2021-40539 | Zoho ManageEngine | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0234 Credential Dumping via Sensitive Memory and Registry Access Correlation v1.0
AN0648 WindowsProcesses accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.Tunable:
AccessMaskTimeWindowParentProcessFilterAN0649 LinuxProcesses opening /proc//mem or /proc//maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.Tunable:TargetProcessNameToolProcessNameAN0650 macOSUnsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.Tunable:KeychainAccessPathSignedBinaryStatus
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1003
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0442defa-b4a2-41c9-ae2c-ea7042fc4701
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 · logsource: product=windows category=ps_script · 189e3b02-82b2-4b90-9662-411eb64486d4
Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.
Author: Thomas Patzke
· 2017-06-14 (modified 2025-01-30) · logsource: product=windows service=security · 1de68c67-af5c-4097-9c85-fe5578e09e67
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Author: Florian Roth (Nextron Systems)
· 2022-03-04 (modified 2024-11-23) · logsource: product=windows category=process_creation · 24e3e58a-646b-4b50-adef-02ef935b9fc8
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Author: Tim Rauch, Janantha Marasinghe, Elastic (original idea)
· 2022-11-08 (modified 2023-01-22) · logsource: product=windows category=process_creation · 2d3cdeec-c0db-45b4-aa86-082f7eb75701
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
· 2023-04-27 · logsource: product=windows category=ps_script · 3245cd30-e015-40ff-a31d-5cadd5f377ec
Detects the execution of the hacktool Rubeus using specific command line flags
Author: Milad Cheraghi
· 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
Author: Swachchhanda Shrawan Poudel
· 2024-02-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 34275eb8-fa19-436b-b959-3d9ecd53fa1f
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
Author: Florian Roth (Nextron Systems)
· 2022-04-27 (modified 2024-01-15) · logsource: product=windows category=process_creation · 37c1333a-a0db-48be-b64b-7393b2386e3b
Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-11 (modified 2026-07-28) · logsource: product=windows category=file_access · 407aecb1-e762-4acf-8c7b-d087bcff3bb6
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 416bc4a2-7217-4519-8dc7-c3271817f1d5
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
Author: Pawel Mazur
· 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc
Detect attempt to enable auditing of TTY input
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 547dfc53-ebf6-4afe-8d2e-793d9574975d
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
Author: Andreas Braathen (mnemonic.io)
· 2025-10-19 · logsource: product=windows service=security · 5d6c375a-18ae-4952-b4f6-8b803f6c8555
Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json.
The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.
Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.
Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
hightest
Author: SecurityAura
· 2022-11-16 (modified 2024-06-27) · logsource: product=windows category=file_event · 6e2a900a-ced9-4e4a-a9c2-13e706f9518a
Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 6e78f90f-0043-4a01-ac41-f97681613a66
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 78cc2dd2-7d20-4d32-93ff-057084c38b93
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Author: sam0x90
· 2021-08-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7df1713a-1a5b-4a4b-a071-dc83b144a101
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
Author: Florian Roth (Nextron Systems)
· 2018-12-19 (modified 2023-04-20) · logsource: product=windows category=process_creation · 7ec2c172-dceb-4c10-92c9-87c1881b7e18
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-27 · logsource: product=windows category=process_creation · 8a1b2c3d-4e5f-6789-abcd-ef1234567890
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
Author: frack113, X__Junior (Nextron Systems)
· 2022-04-09 (modified 2024-07-29) · logsource: product=windows category=file_access · 91cb43db-302a-47e3-b3c8-7ede481e27bf
Detects file access requests to browser credential stores by uncommon processes.
Could indicate potential attempt of credential stealing.
Requires heavy baselining before usage
Author: Julia Fomina, oscd.community
· 2020-10-09 (modified 2025-10-31) · logsource: product=windows category=process_creation · 93671f99-04eb-4ab4-a161-70d446a84003
Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 (modified 2022-12-30) · logsource: product=windows category=process_creation · 97dbf6e2-e436-44d8-abee-4261b24d3e41
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows category=file_event · a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-21 · logsource: product=aws service=cloudtrail · a840e606-7c8c-4684-9bc1-eb6b6155127f
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2019-10-22 (modified 2022-11-10) · logsource: product=windows category=process_creation · b17ea6f7-6e90-447e-a799-e6c0a493d6ce
Shadow Copies creation using operating systems utilities, possible credential access
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-23 (modified 2023-02-02) · logsource: product=windows category=process_creation · baef1ec6-2ca9-47a3-97cc-4cf2bda10b77
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Author: sawwinnnaung
· 2020-05-07 (modified 2023-10-11) · logsource: product=azure service=activitylogs · c1182e02-49a3-481c-b3de-0fadc4091488
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Author: X__Junior (Nextron Systems)
· 2024-07-29 · logsource: product=windows category=file_access · c5f37810-a85f-4186-81e9-33f23abb4141
Detects file access requests to chromium based browser sensitive files by uncommon processes.
Could indicate potential attempt of stealing sensitive information.
Author: Florian Roth (Nextron Systems), Samir Bousseaden
· 2021-11-27 (modified 2023-03-02) · logsource: product=windows category=process_creation · c8da0dfd-4ed0-4b68-962d-13c9c884384e
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Author: Max Altgelt (Nextron Systems)
· 2021-09-21 (modified 2022-12-25) · logsource: product=windows category=ps_script · cd185561-4760-45d6-a63e-a51325112cae
Detects usage of a PowerShell command to dump the live memory of a Windows machine
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · e7d79a1b-25ed-4956-bd56-bd344fa8fd06
Detects instances where a MySQL service on an OpenCanary node has had a login attempt.
Author: Swachchhanda Shrawan Poudel
· 2024-02-12 · logsource: product=windows category=process_creation · e83e8899-c9b2-483b-b355-5decc942b959
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Author: X__Junior (Nextron Systems)
· 2024-07-29 · logsource: product=windows category=file_access · f41b0311-44f9-44f0-816d-dd45e39d4bc8
Detects file access requests to crypto currency files by uncommon processes.
Could indicate potential attempt of crypto currency wallet stealing.