CmdID

CmdID / Techniques / T1003

T1003.006 OS Credential Dumping: DCSync

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync. MITRE ATT&CK

1 Sigma rule T1003.006 on attack.mitre.org

Part of

MITRE ATT&CK
T1003OS Credential Dumping

Sigma rules tagged with it

process creation, the highest levels first
highHackTool - Mimikatz ExecutionTeymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Run mimikatz in interactive mode on the page for mimikatz

mimikatzIdentify

Enable debug privileges (needed for most operations) on the page for mimikatz

mimikatz "privilege::debug"Identify

Dump plaintext passwords, NTLM hashes, and Kerberos tickets from memory on the page for mimikatz

mimikatz "sekurlsa::logonpasswords"Identify

Pass-the-Hash with a specific NTLM hash and launch a command on the page for mimikatz

mimikatz "sekurlsa::pth /user:username /domain:domain /ntlm:hash /run:cmd"Identify

Dump local SAM database hashes on the page for mimikatz

mimikatz "lsadump::sam"Identify

Extract Kerberos tickets and export to a file on the page for mimikatz

mimikatz "kerberos::list /export"Identify

List cryptographic providers on the page for mimikatz-crypto

mimikatz "crypto::providers"Identify

List keys in a cryptographic provider on the page for mimikatz-crypto

mimikatz "crypto::capi"Identify

Export certificates and keys on the page for mimikatz-crypto

mimikatz "crypto::certificates /export"Identify

List master keys on the page for mimikatz-dpapi

mimikatz "dpapi::masterkey /list"Identify

Decrypt a DPAPI blob on the page for mimikatz-dpapi

mimikatz "dpapi::blob /in:blob_file.bin"Identify

Retrieve Chrome credentials using DPAPI on the page for mimikatz-dpapi

mimikatz "dpapi::chrome /in:Login Data"Identify

And 29 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1003.006: a Sigma rule it trips is tagged with it, or its abuse is documented as it.