Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| DEF-SECA-E3 | Security Alerts | Technique Scores | T1003 | OS Credential Dumping |
Comments
Microsoft Defender security alerts explain the suspicious activities detected by Defender for Identity sensors on your network, and the actors and computers involved in each threat. Alert evidence lists contain direct links to the involved users and computers, to help make your investigations easy and direct.
Defender security alerts are divided into the following categories or phases, like the phases seen in a typical cyber-attack kill chain. Learn more about each phase, the alerts designed to detect each attack, and how to use the alerts to help protect your network using the following links:
Reconnaissance and discovery alerts
Persistence and privilege escalation alerts
Credential access alerts
Lateral movement alerts
Other alerts
License: A Microsoft 365 security product license entitles customer use
of Microsoft Defender XDR.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1003.002 | Security Account Manager | 15 |
| T1003.004 | LSA Secrets | 14 |
| T1003.007 | Proc Filesystem | 14 |
| T1003.001 | LSASS Memory | 19 |
| T1003.005 | Cached Domain Credentials | 17 |
| T1003.008 | /etc/passwd and /etc/shadow | 14 |
| T1003.003 | NTDS | 18 |
| T1003.006 | DCSync | 17 |