1. Home
  2. ATT&CK Techniques
  3. T1003 OS Credential Dumping

T1003 OS Credential Dumping Mappings

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.

Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
AC-16 Security and Privacy Attributes Protects T1003 OS Credential Dumping
AC-2 Account Management Protects T1003 OS Credential Dumping
AC-3 Access Enforcement Protects T1003 OS Credential Dumping
AC-4 Information Flow Enforcement Protects T1003 OS Credential Dumping
AC-5 Separation of Duties Protects T1003 OS Credential Dumping
AC-6 Least Privilege Protects T1003 OS Credential Dumping
CA-7 Continuous Monitoring Protects T1003 OS Credential Dumping
CM-2 Baseline Configuration Protects T1003 OS Credential Dumping
CM-5 Access Restrictions for Change Protects T1003 OS Credential Dumping
CM-6 Configuration Settings Protects T1003 OS Credential Dumping
CM-7 Least Functionality Protects T1003 OS Credential Dumping
CP-9 System Backup Protects T1003 OS Credential Dumping
IA-2 Identification and Authentication (organizational Users) Protects T1003 OS Credential Dumping
IA-4 Identifier Management Protects T1003 OS Credential Dumping
IA-5 Authenticator Management Protects T1003 OS Credential Dumping
SC-28 Protection of Information at Rest Protects T1003 OS Credential Dumping
SC-39 Process Isolation Protects T1003 OS Credential Dumping
SI-12 Information Management and Retention Protects T1003 OS Credential Dumping
SI-3 Malicious Code Protection Protects T1003 OS Credential Dumping
SI-4 System Monitoring Protects T1003 OS Credential Dumping
SI-7 Software, Firmware, and Information Integrity Protects T1003 OS Credential Dumping
CVE-2014-1812 n/a uncategorized T1003 OS Credential Dumping
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003 OS Credential Dumping
amazon_inspector Amazon Inspector technique_scores T1003 OS Credential Dumping
Comments
The Amazon Inspector Best Practices assessment package can assess security control "Configure permissions for system directories" that prevents privilege escalation by local users and ensures only the root account can modify/execute system configuration information and binaries. Amazon Inspector does not directly protect against system modifications rather it just checks to see if security controls are in place which can inform decisions around hardening the system. Furthermore, Amazon Inspector only supports a subset of the sub-techniques for this technique. Due to these things and the fact the security control is only supported for Linux platforms, the score is Minimal.
References
  1. https://docs.aws.amazon.com/inspector/latest/userguide/inspector_introduction.html

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1003.008 /etc/passwd and /etc/shadow 18
T1003.005 Cached Domain Credentials 20
T1003.006 DCSync 19
T1003.004 LSA Secrets 16
T1003.001 LSASS Memory 18
T1003.003 NTDS 20
T1003.007 Proc Filesystem 17
T1003.002 Security Account Manager 18