aol.pm

OS Credential Dumping

Technique · ATTACK:enterprise:T1003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1003",
  "title": "OS Credential Dumping",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
  "external_id": "T1003",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:19.735Z",
  "modified": "2025-10-24T17:48:22.201Z",
  "version": "2.2",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Medium Detecting Attempts to Steal Passwords from Memory",
      "url": "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea"
    },
    {
      "source_name": "AdSecurity DCSync Sept 2015",
      "url": "https://adsecurity.org/?p=1729"
    },
    {
      "source_name": "Microsoft DRSR Dec 2017",
      "url": "https://msdn.microsoft.com/library/cc228086.aspx"
    },
    {
      "source_name": "Microsoft NRPC Dec 2017",
      "url": "https://msdn.microsoft.com/library/cc237008.aspx"
    },
    {
      "source_name": "Microsoft GetNCCChanges",
      "url": "https://msdn.microsoft.com/library/dd207691.aspx"
    },
    {
      "source_name": "Microsoft SAMR",
      "url": "https://msdn.microsoft.com/library/cc245496.aspx"
    },
    {
      "source_name": "Powersploit",
      "url": "https://github.com/mattifestation/PowerSploit"
    },
    {
      "source_name": "Samba DRSUAPI",
      "url": "https://wiki.samba.org/index.php/DRSUAPI"
    },
    {
      "source_name": "Harmj0y DCSync Sept 2015",
      "url": "http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/"
    },
    {
      "source_name": "Brining MimiKatz to Unix",
      "url": "https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf"
    }
  ]
}

Explicit source assertions (37)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0314a845-98db-4cf9-ac05-875025017636

Cadet Blizzard emerges as novel threat actor

ATTACK:enterprise:T1003.002 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--050b13e6-22e2-450c-a075-44a79fb79dc9

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f93a49a-11c8-49d8-9b58-e7136e6bc850

BitDefender Chafer May 2020

ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13910722-9dc6-499f-9fbf-0a9cb3daab11

FireEye CARBANAK June 2017

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ef7da45-bf8c-4483-865e-2a1d58f57bb0

Symantec Daggerfly 2023

ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21537040-e89a-4908-95c2-2c5d905bcc2f

Cylance Shaheen Nov 2018

ATTACK:enterprise:S0048 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e80a049-220e-4d47-98f7-c0dbfe245cdc

F-Secure The Dukes

ATTACK:enterprise:G0033 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35aac341-5371-42e8-ad93-3ab94a11b51a

Kaspersky Poseidon Group

ATTACK:enterprise:S0052 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37ad61e7-6520-47d0-81ae-f3d129b49ac1

F-Secure The Dukes

ATTACK:enterprise:T1003.004 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--386a591e-3e8e-4f23-8a5c-60abfa831d30

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d8b368c-57bc-4f36-808a-387a1e2cd3d9

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e3f06c4-3105-4d07-b876-702005e9b59a

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e43af09-b4bb-46dc-87f3-e2b72e70b47a

TrendMicro Tonto Team October 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f75cf7f-1c21-4c22-983b-fac20ea85101

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--782ee381-61f2-4405-b399-9faa99d00fea

win10_asr

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a3426bf-1751-43db-b844-6bf388a4c817

ATTACK:enterprise:S0232 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ad1bbdf-4a00-426a-b130-fb4425ad2622

FireEye Periscope March 2018

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e8ca453-aee5-48c1-a891-f44a742a95ed

ATTACK:enterprise:T1003.006 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9dc0d9c5-1701-47b7-971f-4a1992203776

ATTACK:enterprise:G0039 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0c55c8d-6192-4faa-a5a2-1742fb5815a0

Symantec Suckfly May 2016

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a266294c-18a7-4a6e-8291-a901748c929c

Microsoft Securing Privileged Access

ATTACK:enterprise:M1025 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6f27258-cf6a-4d75-a3f0-5de085d528d2

Microsoft LSA

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7752cff-83f3-4a19-b92a-77201882cea4

Picus BlackByte 2022 · Microsoft BlackByte 2023

ATTACK:enterprise:T1003.007 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9ad8c47-9cec-45c1-8d07-6154d2cc752b

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b149adfe-547f-4cd4-af4a-ea7018a203c1

Symantec Dragonfly

ATTACK:enterprise:T1003.003 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c53e4807-05e4-46d2-9cb9-fd6301ac3738

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7e8689c-25cf-4fac-926e-c55a2414f16c

US District Court Indictment GRU Oct 2018 · ESET Sednit Part 2 · DOJ GRU Indictment Jul 2018

ATTACK:enterprise:T1003.005 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5afd2ff-ca7f-4a53-b2ca-1628fda6f74d

ATTACK:enterprise:G0054 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d93265a6-1f92-472b-9e47-48b7863d8171

Symantec Sowbug Nov 2017

ATTACK:enterprise:T1003.001 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee212490-822c-4851-bf2f-06b8179a9a38

ATTACK:enterprise:M1043 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee8ef62a-fcde-44b0-aa63-4028dad703aa

TechNet Credential Guard · GitHub SHB Credential Guard

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8f09842-7360-461d-98b6-b1e9e6a77332

Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fad2a504-6e00-4892-bf88-b49d6d18788c

Novetta-Axiom

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fbcd00ef-0518-414d-9026-b736f036606a

FireEye APT40 March 2019

ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc31837d-530f-45e5-b9f8-bf6268c3ef03

AdSecurity DCSync Sept 2015 · Microsoft Protected Users Security Group · Microsoft Replication ACL

ATTACK:enterprise:T1003.008 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe061ca4-3182-49b7-a70c-96c58e19d9bc

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe849763-78b9-4b8a-9219-2781ac7b00e8

Microsoft Disable NTLM Nov 2012 · Microsoft WDigest Mit

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.