CyberStack

MITRE ATT&CK / Techniques / T1003

OS Credential Dumping

ID
T1003
Tactics
TA0006 Credential Access
Platforms
Linux, macOS, Windows
Data sources
Process Access, Process Creation, File Access, Active Directory Object Access, Process Metadata
Source
attack.mitre.org
MITRE last modified
25 Oct 2025

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.[11] Credentials can then be used to perform Lateral Movement and access restricted information.

Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

Sub-techniques (8)

Detection

Mitigations (9)

M1015 Active Directory Configuration

Manage the access control list for “Replicating Directory Changes All” and other permissions associated with domain controller replication. [1] [2] Consider adding users to the "Protected Users" Active Directory security group. This can help limit the caching of users' plaintext credentials.[3]

M1017 User Training

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

M1025 Privileged Process Integrity

On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.[4]

M1026 Privileged Account Management

Windows:
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.[5]

Linux:
Scraping the passwords from memory requires root privileges. Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive regions of memory.

M1027 Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

M1028 Operating System Configuration

Consider disabling or restricting NTLM.[6] Consider disabling WDigest authentication.[7]

M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing. [8]

M1041 Encrypt Sensitive Information

Ensure Domain Controller backups are properly secured.

M1043 Credential Access Protection

With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. [9] It also does not protect against all forms of credential dumping. [10]

Groups (13)

Software (7)

References

  1. AdSecurity DCSync Sept 2015
  2. Microsoft Replication ACL
  3. Microsoft Protected Users Security Group
  4. Microsoft LSA
  5. Microsoft Securing Privileged Access
  6. Microsoft Disable NTLM Nov 2012
  7. Microsoft WDigest Mit
  8. win10_asr
  9. TechNet Credential Guard
  10. GitHub SHB Credential Guard
  11. Brining MimiKatz to Unix