{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1003","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"6753bfccb9d20a7a225a8f2c88a60dea92828f8b64939c863f9fe150b49e466e","description":"Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.\n\nSeveral of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1003","external_id":"T1003"},{"source_name":"Medium Detecting Attempts to Steal Passwords from Memory","description":"French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019.","url":"https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea"},{"source_name":"AdSecurity DCSync Sept 2015","description":"Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved December 4, 2017.","url":"https://adsecurity.org/?p=1729"},{"source_name":"Microsoft DRSR Dec 2017","description":"Microsoft. (2017, December 1). MS-DRSR Directory Replication Service (DRS) Remote Protocol. Retrieved December 4, 2017.","url":"https://msdn.microsoft.com/library/cc228086.aspx"},{"source_name":"Microsoft NRPC Dec 2017","description":"Microsoft. (2017, December 1). MS-NRPC - Netlogon Remote Protocol. Retrieved December 6, 2017.","url":"https://msdn.microsoft.com/library/cc237008.aspx"},{"source_name":"Microsoft GetNCCChanges","description":"Microsoft. (n.d.). IDL_DRSGetNCChanges (Opnum 3). Retrieved December 4, 2017.","url":"https://msdn.microsoft.com/library/dd207691.aspx"},{"source_name":"Microsoft SAMR","description":"Microsoft. (n.d.). MS-SAMR Security Account Manager (SAM) Remote Protocol (Client-to-Server) - Transport. Retrieved December 4, 2017.","url":"https://msdn.microsoft.com/library/cc245496.aspx"},{"source_name":"Powersploit","description":"PowerSploit. (n.d.). Retrieved December 4, 2014.","url":"https://github.com/mattifestation/PowerSploit"},{"source_name":"Samba DRSUAPI","description":"SambaWiki. (n.d.). DRSUAPI. Retrieved December 4, 2017.","url":"https://wiki.samba.org/index.php/DRSUAPI"},{"source_name":"Harmj0y DCSync Sept 2015","description":"Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved December 4, 2017.","url":"http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/"},{"source_name":"Brining MimiKatz to Unix","description":"Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.","url":"https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"},{"key":"enterprise/T1003.002","id":"T1003.002","name":"Security Account Manager","page":"techniques/enterprise/T1003.002/"},{"key":"enterprise/T1003.003","id":"T1003.003","name":"NTDS","page":"techniques/enterprise/T1003.003/"},{"key":"enterprise/T1003.004","id":"T1003.004","name":"LSA Secrets","page":"techniques/enterprise/T1003.004/"},{"key":"enterprise/T1003.005","id":"T1003.005","name":"Cached Domain Credentials","page":"techniques/enterprise/T1003.005/"},{"key":"enterprise/T1003.006","id":"T1003.006","name":"DCSync","page":"techniques/enterprise/T1003.006/"},{"key":"enterprise/T1003.007","id":"T1003.007","name":"Proc Filesystem","page":"techniques/enterprise/T1003.007/"},{"key":"enterprise/T1003.008","id":"T1003.008","name":"/etc/passwd and /etc/shadow","page":"techniques/enterprise/T1003.008/"}],"telemetry":[{"id":"DC0071","name":"Active Directory Object Access","page":"telemetry/DC0071/","kind":"attack_component","category":"Windows and directory audit","description":"Access to Active Directory objects and properties.","collection_focus":"Enable Audit Directory Service Access and scoped object SACLs; interpret access masks and property GUIDs in their directory context.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_dn","access","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0071","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","access":"read_property","actor":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0034","name":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component","category":"Host state and inventory","description":"Point-in-time process properties such as owner, executable and start time.","collection_focus":"Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["process_id","image","owner_uid","started_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1003","technique_page":"techniques/enterprise/T1003/","page":"detections/enterprise/T1003/","status":"rule_source_available","counts":{"sigma":33,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"3ec9a16d-0b4f-4967-9542-ebf38ceac7dd","title":"OpenCanary - MSSQL Login Attempt Via SQLAuth","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/3ec9a16d-0b4f-4967-9542-ebf38ceac7dd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_mssql_login_sqlauth.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"6e78f90f-0043-4a01-ac41-f97681613a66","title":"OpenCanary - MSSQL Login Attempt Via Windows Authentication","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/6e78f90f-0043-4a01-ac41-f97681613a66.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_mssql_login_winauth.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"e7d79a1b-25ed-4956-bd56-bd344fa8fd06","title":"OpenCanary - MySQL Login Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/e7d79a1b-25ed-4956-bd56-bd344fa8fd06.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_mysql_login_attempt.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"547dfc53-ebf6-4afe-8d2e-793d9574975d","title":"OpenCanary - REDIS Action Command Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/547dfc53-ebf6-4afe-8d2e-793d9574975d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_redis_command.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"78cc2dd2-7d20-4d32-93ff-057084c38b93","title":"Antivirus Password Dumper Detection","status":"stable","level":"critical","logsource":{"category":"antivirus"},"data_path":"data/detection-rules/78cc2dd2-7d20-4d32-93ff-057084c38b93.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/category/antivirus/av_password_dumper.yml","author":"Florian Roth (Nextron Systems), Arnim Rupp","kind":"sigma"},{"id":"a840e606-7c8c-4684-9bc1-eb6b6155127f","title":"PUA - AWS TruffleHog Execution","status":"experimental","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/a840e606-7c8c-4684-9bc1-eb6b6155127f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_pua_trufflehog.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"c1182e02-49a3-481c-b3de-0fadc4091488","title":"Rare Subscription-level Operations In Azure","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/c1182e02-49a3-481c-b3de-0fadc4091488.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_rare_operations.yml","author":"sawwinnnaung","kind":"sigma"},{"id":"49aae26c-450e-448b-911d-b3c13d178dfc","title":"Linux Keylogging with Pam.d","status":"test","level":"high","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/49aae26c-450e-448b-911d-b3c13d178dfc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"1de68c67-af5c-4097-9c85-fe5578e09e67","title":"WCE wceaux.dll Access","status":"test","level":"critical","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/1de68c67-af5c-4097-9c85-fe5578e09e67.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_mal_wceaux_dll.yml","author":"Thomas Patzke","kind":"sigma"},{"id":"5d6c375a-18ae-4952-b4f6-8b803f6c8555","title":"File Access Of Signal Desktop Sensitive Data","status":"experimental","level":"medium","logsource":{"product":"windows","service":"security","definition":"Requirements: System Access Control List (SACL) policy with attributes List folder/read data on Objects"},"data_path":"data/detection-rules/5d6c375a-18ae-4952-b4f6-8b803f6c8555.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_signal_sensitive_config_access.yml","author":"Andreas Braathen (mnemonic.io)","kind":"sigma"},{"id":"407aecb1-e762-4acf-8c7b-d087bcff3bb6","title":"Credential Manager Access By Uncommon Applications","status":"test","level":"medium","logsource":{"category":"file_access","product":"windows","definition":"Requirements: Microsoft-Windows-Kernel-File ETW provider"},"data_path":"data/detection-rules/407aecb1-e762-4acf-8c7b-d087bcff3bb6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_access/file_access_win_susp_credential_manager_access.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"f41b0311-44f9-44f0-816d-dd45e39d4bc8","title":"Access To Crypto Currency Wallets By Uncommon Applications","status":"test","level":"medium","logsource":{"category":"file_access","product":"windows","definition":"Requirements: Microsoft-Windows-Kernel-File ETW provider"},"data_path":"data/detection-rules/f41b0311-44f9-44f0-816d-dd45e39d4bc8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_access/file_access_win_susp_crypto_currency_wallets.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"6e2a900a-ced9-4e4a-a9c2-13e706f9518a","title":"HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/6e2a900a-ced9-4e4a-a9c2-13e706f9518a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_hktl_remote_cred_dump.yml","author":"SecurityAura","kind":"sigma"},{"id":"416bc4a2-7217-4519-8dc7-c3271817f1d5","title":"Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location","status":"experimental","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/416bc4a2-7217-4519-8dc7-c3271817f1d5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"3245cd30-e015-40ff-a31d-5cadd5f377ec","title":"HackTool - Rubeus Execution - ScriptBlock","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/3245cd30-e015-40ff-a31d-5cadd5f377ec.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml","author":"Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"cd185561-4760-45d6-a63e-a51325112cae","title":"Live Memory Dump Using Powershell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/cd185561-4760-45d6-a63e-a51325112cae.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml","author":"Max Altgelt (Nextron Systems)","kind":"sigma"},{"id":"189e3b02-82b2-4b90-9662-411eb64486d4","title":"Potential Invoke-Mimikatz PowerShell Script","status":"test","level":"high","logsource":{"category":"ps_script","product":"windows"},"data_path":"data/detection-rules/189e3b02-82b2-4b90-9662-411eb64486d4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml","author":"Tim Rauch, Elastic (idea)","kind":"sigma"},{"id":"7df1713a-1a5b-4a4b-a071-dc83b144a101","title":"Esentutl Gather Credentials","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7df1713a-1a5b-4a4b-a071-dc83b144a101.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_esentutl_params.yml","author":"sam0x90","kind":"sigma"},{"id":"24e3e58a-646b-4b50-adef-02ef935b9fc8","title":"Hacktool Execution - Imphash","status":"test","level":"critical","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/24e3e58a-646b-4b50-adef-02ef935b9fc8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_execution_via_imphashes.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"37c1333a-a0db-48be-b64b-7393b2386e3b","title":"Hacktool Execution - PE Metadata","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/37c1333a-a0db-48be-b64b-7393b2386e3b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"7ec2c172-dceb-4c10-92c9-87c1881b7e18","title":"HackTool - Rubeus Execution","status":"stable","level":"critical","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7ec2c172-dceb-4c10-92c9-87c1881b7e18.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_rubeus.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"2d3cdeec-c0db-45b4-aa86-082f7eb75701","title":"Microsoft IIS Service Account Password Dumped","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2d3cdeec-c0db-45b4-aa86-082f7eb75701.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml","author":"Tim Rauch, Janantha Marasinghe, Elastic (original idea)","kind":"sigma"},{"id":"97dbf6e2-e436-44d8-abee-4261b24d3e41","title":"Microsoft IIS Connection Strings Decryption","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/97dbf6e2-e436-44d8-abee-4261b24d3e41.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_iis_connection_strings_decryption.yml","author":"Tim Rauch, Elastic (idea)","kind":"sigma"},{"id":"c8da0dfd-4ed0-4b68-962d-13c9c884384e","title":"Potential Credential Dumping Via LSASS Process Clone","status":"test","level":"critical","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c8da0dfd-4ed0-4b68-962d-13c9c884384e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lsass_process_clone.yml","author":"Florian Roth (Nextron Systems), Samir Bousseaden","kind":"sigma"},{"id":"8a1b2c3d-4e5f-6789-abcd-ef1234567890","title":"PUA - Memory Dump Mount Via MemProcFS","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8a1b2c3d-4e5f-6789-abcd-ef1234567890.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_memprocfs.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"baef1ec6-2ca9-47a3-97cc-4cf2bda10b77","title":"Potential Credential Dumping Attempt Using New NetworkProvider - CLI","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/baef1ec6-2ca9-47a3-97cc-4cf2bda10b77.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_registry_new_network_provider.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"93671f99-04eb-4ab4-a161-70d446a84003","title":"Capture Credentials with Rpcping.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/93671f99-04eb-4ab4-a161-70d446a84003.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml","author":"Julia Fomina, oscd.community","kind":"sigma"},{"id":"e83e8899-c9b2-483b-b355-5decc942b959","title":"Interesting Service Enumeration Via Sc.EXE","status":"test","level":"low","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/e83e8899-c9b2-483b-b355-5decc942b959.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"b17ea6f7-6e90-447e-a799-e6c0a493d6ce","title":"Shadow Copies Creation Using Operating Systems Utilities","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b17ea6f7-6e90-447e-a799-e6c0a493d6ce.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml","author":"Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community","kind":"sigma"},{"id":"2617e7ed-adb7-40ba-b0f3-8f9945fe6c09","title":"Suspicious SYSTEM User Process Creation","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2617e7ed-adb7-40ba-b0f3-8f9945fe6c09.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml","author":"Florian Roth (Nextron Systems), David ANDRE (additional keywords)","kind":"sigma"},{"id":"34275eb8-fa19-436b-b959-3d9ecd53fa1f","title":"Loaded Module Enumeration Via Tasklist.EXE","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/34275eb8-fa19-436b-b959-3d9ecd53fa1f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"0442defa-b4a2-41c9-ae2c-ea7042fc4701","title":"Potential Credential Dumping Attempt Using New NetworkProvider - REG","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/0442defa-b4a2-41c9-ae2c-ea7042fc4701.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_new_network_provider.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4","title":"Potentially Suspicious ODBC Driver Registered","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_odbc_driver_registered_susp.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1003-1","technique_id":"T1003","title":"T1003 OS Credential Dumping","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#credential-access","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":117,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L117","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"4f8e475beab3bf32b6ee6eb057ec7cb0b55a5db3bc4266dd9dcba2d061af4629","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(process_access_to_credential_process OR known_dump_tool_signature OR dump_file_pattern) -> ALERT","log_sources":[{"title":"Endpoint Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#1-endpoint-detection-and-response-telemetry"},{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Memory-Protection and Exploit-Mitigation Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#12-memory-protection-and-exploit-mitigation-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1003-1","technique_id":"T1003","title":"Protected credential memory or stores accessed — T1003 OS Credential Dumping","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#credential-dumping","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":80,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L80","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"72a91e3036a6c99c991ddb7fb6937ca23d92ffa96988c13c1615535994e465dd","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"process-to-protected-resource relationship.","expected_behavior":"only a small approved process set accesses credential resources.","deviation":"first-seen edge or rare process-resource combination.","anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"}],"log_sources":[{"title":"Endpoint Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#1-endpoint-detection-and-response-telemetry"},{"title":"Memory-Protection and Exploit-Mitigation Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#12-memory-protection-and-exploit-mitigation-logs"}],"context_references":[{"title":"Play ransomware joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-352a-play-ransomware.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/231218.pdf"}]}],"anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"}],"strategies":[{"id":"DET0234","name":"Credential Dumping via Sensitive Memory and Registry Access Correlation","url":"https://attack.mitre.org/detectionstrategies/DET0234","stix_id":"x-mitre-detection-strategy--8b8cfd0f-bbe2-417b-b1d2-eebf84d3f008","relationship_id":"relationship--a9f91861-99e7-4dee-b037-9c6fd56e9892","description":"","analytics":[{"id":"AN0648","name":"Analytic 0648","guidance":"Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.","url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0648","platforms":["Windows"],"tuning":[{"field":"AccessMask","description":"Set to detect full access rights (0x1F0FFF) or modify based on tool behavior."},{"field":"TimeWindow","description":"Define how soon access to LSASS is followed by suspicious file or registry activity."},{"field":"ParentProcessFilter","description":"Allowlist known security tools or system processes accessing LSASS."}],"log_sources":[{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN0648","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0648","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0648","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0648","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","platforms":["Windows"],"analytic_id":"AN0648","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0648","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0071","component":"Active Directory Object Access","name":"WinEventLog:Security","channel":"EventCode=4662","platforms":["Windows"],"analytic_id":"AN0648","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0648","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0071/"}]},{"id":"AN0649","name":"Analytic 0649","guidance":"Processes opening /proc/*/mem or /proc/*/maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.","url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0649","platforms":["Linux"],"tuning":[{"field":"TargetProcessName","description":"Define sensitive targets (e.g., sshd, login) being memory-read."},{"field":"ToolProcessName","description":"Flag use of memory dump tools like gcore, gdb, pmap."}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open","platforms":["Linux"],"analytic_id":"AN0649","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0649","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0035","component":"Process Access","name":"auditd:SYSCALL","channel":"ptrace","platforms":["Linux"],"analytic_id":"AN0649","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0649","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0649","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0649","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0650","name":"Analytic 0650","guidance":"Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.","url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0650","platforms":["macOS"],"tuning":[{"field":"KeychainAccessPath","description":"Path to watch for abnormal access, e.g., /Library/Keychains/"},{"field":"SignedBinaryStatus","description":"Filter out signed/trusted binaries."}],"log_sources":[{"component_id":"DC0034","component":"Process Metadata","name":"macos:unifiedlog","channel":"Code Execution & Entitlement Access","platforms":["macOS"],"analytic_id":"AN0650","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0650","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"},{"component_id":"DC0055","component":"File Access","name":"macos:keychain","channel":"Access to Keychain DB or system.keychain","platforms":["macOS"],"analytic_id":"AN0650","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0650","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:osquery","channel":"Invocation of osascript or dylib injection","platforms":["macOS"],"analytic_id":"AN0650","source_url":"https://attack.mitre.org/detectionstrategies/DET0234#AN0650","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0071","name":"Active Directory Object Access","tag":"Active Directory Object Access","page":"telemetry/DC0071/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0034","name":"Process Metadata","tag":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0030","name":"Carbanak","url":"https://attack.mitre.org/software/S0030","kind":"malware","description":"[Carbanak](https://attack.mitre.org/software/S0030) obtains Windows logon password details.(Citation: FireEye CARBANAK June 2017)","relationship_id":"relationship--13910722-9dc6-499f-9fbf-0a9cb3daab11","references":[{"source_name":"FireEye CARBANAK June 2017","description":"Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}]},{"id":"S0048","name":"PinchDuke","url":"https://attack.mitre.org/software/S0048","kind":"malware","description":"[PinchDuke](https://attack.mitre.org/software/S0048) steals credentials from compromised hosts. [PinchDuke](https://attack.mitre.org/software/S0048)'s credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by [PinchDuke](https://attack.mitre.org/software/S0048) include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).(Citation: F-Secure The Dukes)","relationship_id":"relationship--2e80a049-220e-4d47-98f7-c0dbfe245cdc","references":[{"source_name":"F-Secure The Dukes","description":"F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}]},{"id":"S0052","name":"OnionDuke","url":"https://attack.mitre.org/software/S0052","kind":"malware","description":"[OnionDuke](https://attack.mitre.org/software/S0052) steals credentials from its victims.(Citation: F-Secure The Dukes)","relationship_id":"relationship--37ad61e7-6520-47d0-81ae-f3d129b49ac1","references":[{"source_name":"F-Secure The Dukes","description":"F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}]},{"id":"S0094","name":"Trojan.Karagany","url":"https://attack.mitre.org/software/S0094","kind":"malware","description":"[Trojan.Karagany](https://attack.mitre.org/software/S0094) can dump passwords and save them into <code>\\ProgramData\\Mail\\MailAg\\pwds.txt</code>.(Citation: Symantec Dragonfly)","relationship_id":"relationship--b149adfe-547f-4cd4-af4a-ea7018a203c1","references":[{"source_name":"Symantec Dragonfly","description":"Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"}]},{"id":"S0232","name":"HOMEFRY","url":"https://attack.mitre.org/software/S0232","kind":"malware","description":"[HOMEFRY](https://attack.mitre.org/software/S0232) can perform credential dumping.(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--7ad1bbdf-4a00-426a-b130-fb4425ad2622","references":[{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0379","name":"Revenge RAT","url":"https://attack.mitre.org/software/S0379","kind":"malware","description":"[Revenge RAT](https://attack.mitre.org/software/S0379) has a plugin for credential harvesting.(Citation: Cylance Shaheen Nov 2018)","relationship_id":"relationship--21537040-e89a-4908-95c2-2c5d905bcc2f","references":[{"source_name":"Cylance Shaheen Nov 2018","description":"Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019.","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"id":"S1146","name":"MgBot","url":"https://attack.mitre.org/software/S1146","kind":"malware","description":"[MgBot](https://attack.mitre.org/software/S1146) includes modules for dumping and capturing credentials from process memory.(Citation: Symantec Daggerfly 2023)","relationship_id":"relationship--1ef7da45-bf8c-4483-865e-2a1d58f57bb0","references":[{"source_name":"Symantec Daggerfly 2023","description":"Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]}],"actors":[{"id":"G0001","name":"Axiom","url":"https://attack.mitre.org/groups/G0001","kind":"intrusion-set","description":"[Axiom](https://attack.mitre.org/groups/G0001) has been known to dump credentials.(Citation: Novetta-Axiom)","relationship_id":"relationship--fad2a504-6e00-4892-bf88-b49d6d18788c","references":[{"source_name":"Novetta-Axiom","description":"Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) regularly deploys both publicly available (ex: [Mimikatz](https://attack.mitre.org/software/S0002)) and custom password retrieval tools on victims.(Citation: ESET Sednit Part 2)(Citation: DOJ GRU Indictment Jul 2018)(Citation: US District Court Indictment GRU Oct 2018)\t","relationship_id":"relationship--c7e8689c-25cf-4fac-926e-c55a2414f16c","references":[{"source_name":"US District Court Indictment GRU Oct 2018","description":"Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"DOJ GRU Indictment Jul 2018","description":"Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"id":"G0033","name":"Poseidon Group","url":"https://attack.mitre.org/groups/G0033","kind":"intrusion-set","description":"[Poseidon Group](https://attack.mitre.org/groups/G0033) conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.(Citation: Kaspersky Poseidon Group)","relationship_id":"relationship--35aac341-5371-42e8-ad93-3ab94a11b51a","references":[{"source_name":"Kaspersky Poseidon Group","description":"Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"id":"G0039","name":"Suckfly","url":"https://attack.mitre.org/groups/G0039","kind":"intrusion-set","description":"[Suckfly](https://attack.mitre.org/groups/G0039) used a signed credential-dumping tool to obtain victim account credentials.(Citation: Symantec Suckfly May 2016)","relationship_id":"relationship--a0c55c8d-6192-4faa-a5a2-1742fb5815a0","references":[{"source_name":"Symantec Suckfly May 2016","description":"DiMaggio, J. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.","url":"http://www.symantec.com/connect/blogs/indian-organizations-targeted-suckfly-attacks"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) used GetPassword_x64 to harvest credentials.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--6f75cf7f-1c21-4c22-983b-fac20ea85101","references":[{"source_name":"Cybereason Oceanlotus May 2017","description":"Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"G0054","name":"Sowbug","url":"https://attack.mitre.org/groups/G0054","kind":"intrusion-set","description":"[Sowbug](https://attack.mitre.org/groups/G0054) has used credential dumping tools.(Citation: Symantec Sowbug Nov 2017)","relationship_id":"relationship--d93265a6-1f92-472b-9e47-48b7863d8171","references":[{"source_name":"Symantec Sowbug Nov 2017","description":"Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"id":"G0065","name":"Leviathan","url":"https://attack.mitre.org/groups/G0065","kind":"intrusion-set","description":"[Leviathan](https://attack.mitre.org/groups/G0065) has used publicly available tools to dump password hashes, including [HOMEFRY](https://attack.mitre.org/software/S0232).(Citation: FireEye APT40 March 2019)","relationship_id":"relationship--fbcd00ef-0518-414d-9026-b736f036606a","references":[{"source_name":"FireEye APT40 March 2019","description":"Plan, F., et al. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used different versions of Mimikatz to obtain credentials.(Citation: BitDefender Chafer May 2020)","relationship_id":"relationship--0f93a49a-11c8-49d8-9b58-e7136e6bc850","references":[{"source_name":"BitDefender Chafer May 2020","description":"Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020.","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) utilized “Hdump” to dump credentials from memory.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023)","relationship_id":"relationship--3d8b368c-57bc-4f36-808a-387a1e2cd3d9","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","description":"Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"id":"G0131","name":"Tonto Team","url":"https://attack.mitre.org/groups/G0131","kind":"intrusion-set","description":"[Tonto Team](https://attack.mitre.org/groups/G0131) has used a variety of credential dumping tools.(Citation: TrendMicro Tonto Team October 2020) ","relationship_id":"relationship--6e43af09-b4bb-46dc-87f3-e2b72e70b47a","references":[{"source_name":"TrendMicro Tonto Team October 2020","description":"Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021.","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.(Citation: Cadet Blizzard emerges as novel threat actor)","relationship_id":"relationship--0314a845-98db-4cf9-ac05-875025017636","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","description":"Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and [Mimikatz](https://attack.mitre.org/software/S0002) to dump credentials from victim systems.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--a7752cff-83f3-4a19-b92a-77201882cea4","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has used the SecretsDump module within [Impacket](https://attack.mitre.org/software/S0357) can perform credential dumping to obtain account and password information.(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)","relationship_id":"relationship--f8f09842-7360-461d-98b6-b1e9e6a77332","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","description":"Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]}],"mitigations":[{"id":"M1015","name":"Active Directory Configuration","url":"https://attack.mitre.org/mitigations/M1015","kind":"course-of-action","description":"\nManage the access control list for “Replicating Directory Changes All” and other permissions associated with domain controller replication. (Citation: AdSecurity DCSync Sept 2015) (Citation: Microsoft Replication ACL) Consider adding users to the \"Protected Users\" Active Directory security group. This can help limit the caching of users' plaintext credentials.(Citation: Microsoft Protected Users Security Group)","relationship_id":"relationship--fc31837d-530f-45e5-b9f8-bf6268c3ef03","references":[{"source_name":"AdSecurity DCSync Sept 2015","description":"Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved December 4, 2017.","url":"https://adsecurity.org/?p=1729"},{"source_name":"Microsoft Protected Users Security Group","description":"Microsoft. (2016, October 12). Protected Users Security Group. Retrieved May 29, 2020.","url":"https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group"},{"source_name":"Microsoft Replication ACL","description":"Microsoft. (n.d.). How to grant the \"Replicating Directory Changes\" permission for the Microsoft Metadirectory Services ADMA service account. Retrieved December 4, 2017.","url":"https://support.microsoft.com/help/303972/how-to-grant-the-replicating-directory-changes-permission-for-the-micr"}]},{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.","relationship_id":"relationship--7e8ca453-aee5-48c1-a891-f44a742a95ed","references":[]},{"id":"M1025","name":"Privileged Process Integrity","url":"https://attack.mitre.org/mitigations/M1025","kind":"course-of-action","description":"\nOn Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.(Citation: Microsoft LSA)","relationship_id":"relationship--a6f27258-cf6a-4d75-a3f0-5de085d528d2","references":[{"source_name":"Microsoft LSA","description":"Microsoft. (2013, July 31). Configuring Additional LSA Protection. Retrieved February 13, 2015.","url":"https://technet.microsoft.com/en-us/library/dn408187.aspx"}]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Windows:\nDo not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.(Citation: Microsoft Securing Privileged Access)\n\nLinux:\nScraping the passwords from memory requires root privileges. Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive regions of memory.","relationship_id":"relationship--a266294c-18a7-4a6e-8291-a901748c929c","references":[{"source_name":"Microsoft Securing Privileged Access","description":"Plett, C., Poggemeyer, L. (12, October 26). Securing Privileged Access Reference Material. Retrieved April 25, 2017.","url":"https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#a-nameesaebmaesae-administrative-forest-design-approach"}]},{"id":"M1027","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M1027","kind":"course-of-action","description":"Ensure that local administrator accounts have complex, unique passwords across all systems on the network.","relationship_id":"relationship--7a3426bf-1751-43db-b844-6bf388a4c817","references":[]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"\nConsider disabling or restricting NTLM.(Citation: Microsoft Disable NTLM Nov 2012) Consider disabling WDigest authentication.(Citation: Microsoft WDigest Mit)","relationship_id":"relationship--fe849763-78b9-4b8a-9219-2781ac7b00e8","references":[{"source_name":"Microsoft Disable NTLM Nov 2012","description":"Microsoft. (2012, November 29). Using security policies to restrict NTLM traffic. Retrieved December 4, 2017.","url":"https://technet.microsoft.com/library/jj865668.aspx"},{"source_name":"Microsoft WDigest Mit","description":"Microsoft. (2014, May 13). Microsoft Security Advisory: Update to improve credentials protection and management. Retrieved June 8, 2020.","url":"https://support.microsoft.com/en-us/help/2871997/microsoft-security-advisory-update-to-improve-credentials-protection-a"}]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing. (Citation: win10_asr)","relationship_id":"relationship--782ee381-61f2-4405-b399-9faa99d00fea","references":[{"source_name":"win10_asr","description":"Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}]},{"id":"M1041","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M1041","kind":"course-of-action","description":"Ensure Domain Controller backups are properly secured.","relationship_id":"relationship--3e3f06c4-3105-4d07-b876-702005e9b59a","references":[]},{"id":"M1043","name":"Credential Access Protection","url":"https://attack.mitre.org/mitigations/M1043","kind":"course-of-action","description":"With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. (Citation: TechNet Credential Guard) It also does not protect against all forms of credential dumping. (Citation: GitHub SHB Credential Guard)","relationship_id":"relationship--ee8ef62a-fcde-44b0-aa63-4028dad703aa","references":[{"source_name":"TechNet Credential Guard","description":"Lich, B. (2016, May 31). Protect derived domain credentials with Credential Guard. Retrieved June 1, 2016.","url":"https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard"},{"source_name":"GitHub SHB Credential Guard","description":"NSA IAD. (2017, April 20). Secure Host Baseline - Credential Guard. Retrieved April 25, 2017.","url":"https://github.com/iadgov/Secure-Host-Baseline/tree/master/Credential%20Guard"}]}],"candidates":[{"id":"0b207037-813c-4444-ac3f-b597cf280a67","name":"Send NTLM Hash with RPC Test Connection","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003/T1003.yaml","description":"RpcPing command can be used to send an RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. \nRef: https://twitter.com/vysecurity/status/974806438316072960","inputs":{"custom_port":{"description":"Specify the custom port number","type":"integer","default":"1234"},"server_ip":{"description":"Specify the server IP address. If not specified, the loop back IP will be used","type":"string","default":"127.0.0.1"}},"dependencies":[],"source_definition_sha256":"409db41afbf0dd27c0b975ef99dd25cebdc2bc35639ee5441a2acf09bb64fe19"},{"id":"42510244-5019-48fa-a0e5-66c3b76e6049","name":"Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using config)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003/T1003.yaml","description":"AppCmd.exe is a command line utility which is used for managing an IIS web server. The config command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes.\n[Reference](https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA)","inputs":{},"dependencies":[{"description":"IIS must be installed prior to running the test"}],"source_definition_sha256":"c9d026fd2af06766b29708d40e7c643eaf4999568e1d6d9606644c16cbd828dc"},{"id":"6c7a4fd3-5b0b-4b30-a93e-39411b25d889","name":"Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using list)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003/T1003.yaml","description":"AppCmd.exe is a command line utility which is used for managing an IIS web server. The list command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes.\n[Reference](https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA)","inputs":{},"dependencies":[{"description":"IIS must be installed prior to running the test"}],"source_definition_sha256":"6c789313acbb6e04681807b076720de2b8462d02a7f77ad8f5e6f029108cca03"},{"id":"84113186-ed3c-4d0d-8a3c-8980c86c1f4a","name":"Dump Credential Manager using keymgr.dll and rundll32.exe","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003/T1003.yaml","description":"This test executes the exported function `KRShowKeyMgr` located in `keymgr.dll` using `rundll32.exe`. It opens a window that allows to export stored Windows credentials from the credential manager to a file (`.crd` by default). The file can then be retrieved and imported on an attacker-controlled computer to list the credentials get the passwords. The only limitation is that it requires a CTRL+ALT+DELETE input from the attacker, which can be achieve multiple ways (e.g. a custom implant with remote control capabilities, enabling RDP, etc.).\nReference: https://twitter.com/0gtweet/status/1415671356239216653","inputs":{},"dependencies":[],"source_definition_sha256":"b7fce637e939e7a143198172d1eb48ee5529471611a783b1df70dfbdfe48551b"},{"id":"96345bfc-8ae7-4b6a-80b7-223200f24ef9","name":"Gsecdump","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003/T1003.yaml","description":"Dump credentials from memory using Gsecdump.\n\nUpon successful execution, you should see domain\\username's followed by two 32 character hashes.\n\nIf you see output that says \"compat: error: failed to create child process\", execution was likely blocked by Anti-Virus. \nYou will receive only error output if you do not run this test from an elevated context (run as administrator)\n\nIf you see a message saying \"The system cannot find the path specified\", try using the get-prereq_commands to download and install Gsecdump first.\n","inputs":{"gsecdump_exe":{"description":"Path to the Gsecdump executable","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\gsecdump.exe"},"gsecdump_bin_hash":{"description":"File hash of the Gsecdump binary file","type":"string","default":"94CAE63DCBABB71C5DD43F55FD09CAEFFDCD7628A02A112FB3CBA36698EF72BC"},"gsecdump_url":{"description":"Path to download Gsecdump binary file","type":"url","default":"https://web.archive.org/web/20150606043951if_/http://www.truesec.se/Upload/Sakerhet/Tools/gsecdump-v2b5.exe"}},"dependencies":[{"description":"Gsecdump must exist on disk at specified location (#{gsecdump_exe})\n"}],"source_definition_sha256":"19ecc00b51da11c51a980f3d99a198fad63435f7360bfb82334d9f59994eeac7"},{"id":"9e2173c0-ba26-4cdf-b0ed-8c54b27e3ad6","name":"Credential Dumping with NPPSpy","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003/T1003.yaml","description":"Changes ProviderOrder Registry Key Parameter and creates Key for NPPSpy.\nAfter user's logging in cleartext password is saved in C:\\NPPSpy.txt.\nClean up deletes the files and reverses Registry changes.\nNPPSpy Source: https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy","inputs":{},"dependencies":[{"description":"NPPSpy.dll must be available in ExternalPayloads directory"}],"source_definition_sha256":"ecf5ff9c7d60d28d3acbac1e80f792fc0b8b447290a1d30899e37bd60d8d2b80"},{"id":"d400090a-d8ca-4be0-982e-c70598a23de9","name":"Dump svchost.exe to gather RDP credentials","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003/T1003.yaml","description":"The svchost.exe contains the RDP plain-text credentials.\nSource: https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/\n\nUpon successful execution, you should see the following file created $env:TEMP\\svchost-exe.dmp.\n","inputs":{},"dependencies":[],"source_definition_sha256":"beba6f3714ac6df352fa49de7983a0d4cc415cc20bd4c3724b5dd589e683fda0"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1003":"/ttp-simulation/techniques/enterprise/T1003/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1003","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0071","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","access":"read_property","actor":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}}]}}