CmdID

CmdID / Techniques

T1003 OS Credential Dumping

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. MITRE ATT&CK

6 programs on CmdID 14 Sigma rules T1003 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1003.001OS Credential Dumping: LSASS Memory
T1003.002OS Credential Dumping: Security Account Manager
T1003.003OS Credential Dumping: NTDS
T1003.004OS Credential Dumping: LSA Secrets
T1003.005OS Credential Dumping: Cached Domain Credentials
T1003.006OS Credential Dumping: DCSync

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
createdump.exeDumprdrleakdiag.exeDumprpcping.exeCredentialssc.exeits Sigma rulessqldumper.exeDumptttracer.exeDump

Sigma rules tagged with it

process creation, the highest levels first
criticalHackTool - Rubeus ExecutionFlorian Roth (Nextron Systems) · Windows
criticalPotential Credential Dumping Via LSASS Process CloneFlorian Roth (Nextron Systems), Samir Bousseaden · Windows
highHacktool Execution - PE MetadataFlorian Roth (Nextron Systems) · Windows
highMicrosoft IIS Connection Strings DecryptionTim Rauch, Elastic (idea) · Windows
highMicrosoft IIS Service Account Password DumpedTim Rauch, Janantha Marasinghe, Elastic (original idea) · Windows
highPotential Credential Dumping Attempt Using New NetworkProvider - CLINasreddine Bencherchali (Nextron Systems) · Windows
highPUA - Memory Dump Mount Via MemProcFSSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious SYSTEM User Process CreationFlorian Roth (Nextron Systems), David ANDRE (additional keywords) · Windows
mediumCapture Credentials with Rpcping.exeJulia Fomina, oscd.community · Windows
mediumEsentutl Gather Credentialssam0x90 · Windows
mediumLoaded Module Enumeration Via Tasklist.EXESwachchhanda Shrawan Poudel · Windows
mediumPotential Exploitation of CVE-2025-5054 or CVE-2025-4598Milad Cheraghi · Linux
mediumShadow Copies Creation Using Operating Systems UtilitiesTeymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community · Windows
lowInteresting Service Enumeration Via Sc.EXESwachchhanda Shrawan Poudel · Windows