CmdID

CmdID / Techniques / T1003

T1003.001 OS Credential Dumping: LSASS Memory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). MITRE ATT&CK

9 programs on CmdID 31 Sigma rules T1003.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1003OS Credential Dumping

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
adplus.exeDumpcomsvcs.dllDumpcreatedump.exeits Sigma rulesdump64.exeDumpdumpminitool.exeDumpprocdump.exeits Sigma rulesrdrleakdiag.exeDumprundll32.exeDumpsqldumper.exeDump

Sigma rules tagged with it

process creation, the highest levels first
criticalAPT31 Judgement Panda ActivityFlorian Roth (Nextron Systems) · Windows
criticalHackTool - Dumpert Process Dumper ExecutionFlorian Roth (Nextron Systems) · Windows
criticalHackTool - Inveigh ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
criticalHackTool - SafetyKatz ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
criticalHackTool - Windows Credential Editor (WCE) ExecutionFlorian Roth (Nextron Systems) · Windows
criticalNotPetya Ransomware ActivityFlorian Roth (Nextron Systems), Tom Ueltschi · Windows
criticalPotential Credential Dumping Via LSASS Process CloneFlorian Roth (Nextron Systems), Samir Bousseaden · Windows
highCreateDump Process DumpFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highHackTool - CrackMapExec Process PatternsFlorian Roth (Nextron Systems) · Windows
highHackTool - CreateMiniDump ExecutionFlorian Roth (Nextron Systems) · Windows
highHackTool - Doppelanger LSASS Dumper ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highHackTool - HandleKatz LSASS Dumper ExecutionFlorian Roth (Nextron Systems) · Windows
highHackTool - Mimikatz ExecutionTeymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton · Windows
highHackTool - WSASS ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highHackTool - XORDump ExecutionFlorian Roth (Nextron Systems) · Windows
highLSASS Dump Keyword In CommandLineE.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows
highPotential Adplus.EXE AbuseNasreddine Bencherchali (Nextron Systems) · Windows
highPotential Credential Dumping Via WER@pbssubhash , Nasreddine Bencherchali · Windows
highPotential LSASS Process Dump Via ProcdumpFlorian Roth (Nextron Systems) · Windows
highPotential SysInternals ProcDump EvasionFlorian Roth (Nextron Systems) · Windows
highPotential Windows Defender AV Bypass Via Dump64.EXE RenameAustin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highPPL Tampering Via WerFaultSecureJason (https://github.com/0xbcf) · Windows
highProcess Access via TrolleyExpress ExclusionFlorian Roth (Nextron Systems) · Windows
highProcess Memory Dump Via Comsvcs.DLLFlorian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highProcess Memory Dump via RdrLeakDiag.EXECedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) · Windows
highPUA - Memory Dump Mount Via MemProcFSSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highRenamed CreateDump Utility ExecutionFlorian Roth (Nextron Systems) · Windows
highSuspicious DumpMinitool ExecutionFlorian Roth (Nextron Systems) · Windows
mediumDumping Process via Sqldumper.exeKirill Kiryanov, oscd.community · Windows
mediumDumpMinitool ExecutionNasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) · Windows
mediumProcdump ExecutionFlorian Roth (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Run mimikatz in interactive mode on the page for mimikatz

mimikatzIdentify

Enable debug privileges (needed for most operations) on the page for mimikatz

mimikatz "privilege::debug"Identify

Dump plaintext passwords, NTLM hashes, and Kerberos tickets from memory on the page for mimikatz

mimikatz "sekurlsa::logonpasswords"Identify

Pass-the-Hash with a specific NTLM hash and launch a command on the page for mimikatz

mimikatz "sekurlsa::pth /user:username /domain:domain /ntlm:hash /run:cmd"Identify

Dump local SAM database hashes on the page for mimikatz

mimikatz "lsadump::sam"Identify

Extract Kerberos tickets and export to a file on the page for mimikatz

mimikatz "kerberos::list /export"Identify

List cryptographic providers on the page for mimikatz-crypto

mimikatz "crypto::providers"Identify

List keys in a cryptographic provider on the page for mimikatz-crypto

mimikatz "crypto::capi"Identify

Export certificates and keys on the page for mimikatz-crypto

mimikatz "crypto::certificates /export"Identify

List master keys on the page for mimikatz-dpapi

mimikatz "dpapi::masterkey /list"Identify

Decrypt a DPAPI blob on the page for mimikatz-dpapi

mimikatz "dpapi::blob /in:blob_file.bin"Identify

Retrieve Chrome credentials using DPAPI on the page for mimikatz-dpapi

mimikatz "dpapi::chrome /in:Login Data"Identify

And 29 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1003.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.