Skip to content

Security Account Manager

Subtechnique · ATTACK:enterprise:T1003.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1003.002",
  "title": "Security Account Manager",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1003/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--1644e709-12d2-41e5-a60f-3470991f5011",
  "external_id": "T1003.002",
  "domain": "enterprise",
  "created": "2020-02-11T18:42:07.281Z",
  "modified": "2026-05-12T15:12:00.621Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "GitHub Creddump7",
      "url": "https://github.com/Neohapsis/creddump7"
    }
  ]
}

Explicit source assertions (42)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01122760-11f7-4fc9-8500-65ee57a6494f

Symantec Daggerfly 2023

ATTACK:enterprise:T1003.002 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--050b13e6-22e2-450c-a075-44a79fb79dc9

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--099cdf98-eece-47a5-821f-f29b866699d6

CME Github September 2018

ATTACK:enterprise:S0008 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--108a1655-faba-4016-a276-c224665cb5c4

Microsoft Gsecdump

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a28a0a2-8e2f-4c42-b6b0-0ffe3d821528

Cybereason Soft Cell June 2019

ATTACK:enterprise:C0041 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20295e2e-8cb9-43d2-905d-13a9ecf6cde4

Dragos FROSTYGOOP 2024

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20785dd8-7692-4dcd-81ee-06bc9faa001c

Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35e6542c-b796-478b-b42d-d5b4ddf511d5

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--427594ef-614a-4e8e-a6ac-abccc0645ada

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44262e7a-8121-4679-a476-2d09279b7f92

JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fd8f00b-2524-4c93-b49d-2f43cbe4aa5b

ATTACK:enterprise:S0006 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57a1f1a8-f1c0-4b7c-b5b4-f283a278833c

Wikipedia pwdump

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63759a0f-39e8-4d94-ab20-3bdba67ca502

US-CERT TA18-074A

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--644d2862-2836-41dd-ba3f-05e23278a5e6

Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and Strong

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65ea5fb8-dbd5-4811-aa3f-fde412fc7688

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c7c4191-2d75-4ce8-b937-b9abb77d7b5b

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cb45812-e3cb-4f8b-949c-0e20bbeb6b15

Unit42 Agrius 2023

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d552780-38aa-451b-9b37-a82a5400cd0e

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--789a2c4e-9152-4b83-a275-58f6b5262a81

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--791d8691-7e06-4052-8c49-1a9f57ccf09d

McAfee Night Dragon

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f04a14f-ab65-4ad5-9d67-a4b509ba8087

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81a6f575-386c-4d8f-ac6c-fa293141eb60

Rostovcev APT41 2021

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--852009ed-1b50-4b08-9e77-53f0271d995c

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8fdfcd23-4608-4a40-98fc-2e4baa8d6a41

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9066dcee-7c80-429c-a5cc-77458e891349

PWC Cloud Hopper Technical Annex April 2017 · Github AD-Pentest-Script

ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--932fa199-f4c0-4c39-bb30-a412607ee299

F-Secure CozyDuke

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a829622f-60cf-4e24-afce-fb89270e95cb

Dell TG-3390 · SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab5d6e11-8449-4170-b2a4-e7b67708b228

Nearest Neighbor Volexity

ATTACK:enterprise:S0080 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac72c3da-6b58-4f66-8476-8d3cc9ccf6bd

Symantec Backdoor.Mivast

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afee7475-8e61-4bed-98f6-2cee6926e1c8

Microsoft Disable NTLM Nov 2012

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b39c536a-55f1-485a-8235-24acb39d0be6

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b69fa422-d118-4d30-948b-422e737b1116

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:S0371 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8133b35-52b8-4407-9845-a00b6a739cdc

FireEye APT33 Guardrail

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c96e7dda-d05c-458a-8332-9e7851bb4775

FireEye KEGTAP SINGLEMALT October 2020

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfd34530-f0d4-4f55-8169-77e97063c7a6

AI-Mexico-Govt-Breach

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d01869cb-74bb-4ad9-ac5e-9c7706f323d1

F-Secure The Dukes

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc7e8f00-d57c-4cfd-971c-510ede375c2f

cobaltstrike manual

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dddfe71c-cdf1-4473-9f57-c95132d973eb

ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4030866-a970-4af5-9d50-b33c7751a8ba

CrowdStrike IceApple May 2022

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e51a1670-52b4-4a0e-b123-7b0ddcf30060

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eff75944-0c22-45bb-bda5-db848836f02b

Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024

ATTACK:enterprise:S0120 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1d5a985-406e-4b03-9f55-2706a2adba92

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.