1200KM / tool
gsecdump — Attack Tool
gsecdump is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: gsecdump
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- APT1 · G0006 · Pinned relationship source (relationship--6e366a30-cf75-4a47-855f-91a006014ada)
- PittyTiger · G0011 · Pinned relationship source (relationship--7ed93170-2dba-4e59-b0f0-7c716c73bdc0)
- Threat Group-3390 · G0027 · Pinned relationship source (relationship--3b6fc69c-9759-465a-b09c-a6161e4e2f56)
- BRONZE BUTLER · G0060 · Pinned relationship source (relationship--fda1acb3-8e87-4fff-ae19-7e6a2ff9d6c3)
- Tonto Team · G0131 · Pinned relationship source (relationship--fcc1d2e7-f41d-4a06-85c6-f00ea602ddac)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.