1. Home
  2. ATT&CK Techniques
  3. T1003 OS Credential Dumping

T1003 OS Credential Dumping Mappings

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.

Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-16 Security and Privacy Attributes Protects T1003 OS Credential Dumping
AC-02 Account Management Protects T1003 OS Credential Dumping
AC-03 Access Enforcement Protects T1003 OS Credential Dumping
AC-04 Information Flow Enforcement Protects T1003 OS Credential Dumping
AC-05 Separation of Duties Protects T1003 OS Credential Dumping
AC-06 Least Privilege Protects T1003 OS Credential Dumping
CA-07 Continuous Monitoring Protects T1003 OS Credential Dumping
CM-02 Baseline Configuration Protects T1003 OS Credential Dumping
CM-05 Access Restrictions for Change Protects T1003 OS Credential Dumping
CM-06 Configuration Settings Protects T1003 OS Credential Dumping
CM-07 Least Functionality Protects T1003 OS Credential Dumping
CP-09 System Backup Protects T1003 OS Credential Dumping
IA-02 Identification and Authentication (organizational Users) Protects T1003 OS Credential Dumping
IA-04 Identifier Management Protects T1003 OS Credential Dumping
IA-05 Authenticator Management Protects T1003 OS Credential Dumping
SC-28 Protection of Information at Rest Protects T1003 OS Credential Dumping
SC-39 Process Isolation Protects T1003 OS Credential Dumping
SI-12 Information Management and Retention Protects T1003 OS Credential Dumping
SI-02 Flaw Remediation Protects T1003 OS Credential Dumping
SI-03 Malicious Code Protection Protects T1003 OS Credential Dumping
SI-04 System Monitoring Protects T1003 OS Credential Dumping
SI-07 Software, Firmware, and Information Integrity Protects T1003 OS Credential Dumping
DEF-SECA-E3 Security Alerts Technique Scores T1003 OS Credential Dumping

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1003.002 Security Account Manager 15
T1003.004 LSA Secrets 14
T1003.007 Proc Filesystem 14
T1003.001 LSASS Memory 19
T1003.005 Cached Domain Credentials 17
T1003.008 /etc/passwd and /etc/shadow 14
T1003.003 NTDS 18
T1003.006 DCSync 17