1200KM / simulation
T1003 OS Credential Dumping — Attack Simulation
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional…
Technique description
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional…
At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.
Official ATT&CK definition · Detection rules and anomaly models
Documented simulation candidates
- Send NTLM Hash with RPC Test Connection
Procedure 0b207037-813c-4444-ac3f-b597cf280a67; elevation not declared required; cleanup not declared. Not executed or individually validated.
- Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using config)
Procedure 42510244-5019-48fa-a0e5-66c3b76e6049; elevation required; cleanup not declared. Not executed or individually validated.
- Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using list)
Procedure 6c7a4fd3-5b0b-4b30-a93e-39411b25d889; elevation required; cleanup not declared. Not executed or individually validated.
- Dump Credential Manager using keymgr.dll and rundll32.exe
Procedure 84113186-ed3c-4d0d-8a3c-8980c86c1f4a; elevation not declared required; cleanup not declared. Not executed or individually validated.
- Gsecdump
Procedure 96345bfc-8ae7-4b6a-80b7-223200f24ef9; elevation required; cleanup not declared. Not executed or individually validated.
- Credential Dumping with NPPSpy
Procedure 9e2173c0-ba26-4cdf-b0ed-8c54b27e3ad6; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- Dump svchost.exe to gather RDP credentials
Procedure d400090a-d8ca-4be0-982e-c70598a23de9; elevation required; cleanup present, not reviewed. Not executed or individually validated.
Connected ecosystem references
Linked tags
Detection and collection
Attack tools
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing research
Connected anomaly research
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.