1200KM / tool
pwdump — Attack Tool
pwdump is a credential dumper.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: pwdump
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- APT1 · G0006 · Pinned relationship source (relationship--de979692-5ca5-4874-bfc8-91cea8697ef1)
- Threat Group-3390 · G0027 · Pinned relationship source (relationship--deb55b94-e38c-4941-9ebd-8cc3343c3eae)
- menuPass · G0045 · Pinned relationship source (relationship--4aa62b6b-7441-4ece-9cb0-2a5bcb46f966)
- FIN5 · G0053 · Pinned relationship source (relationship--ab83d817-57b8-4970-afc6-fbd70c6e3760)
- APT39 · G0087 · Pinned relationship source (relationship--3b1a912a-9854-428f-9dde-bd2100c554d8)
- APT41 · G0096 · Pinned relationship source (relationship--b98ed6ce-be41-4388-ac56-35b4e2a0bbe6)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.