T1003: OS Credential Dumping
AI Answer
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated (Source: MITRE ATT&CK T1003)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1003 |
| Name | OS Credential Dumping |
| Tactic | Credential Access (credential-access) |
| Platforms | Linux, macOS, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, OS Credential Dumping (T1003) is one of the highest-connectivity ATT&CK techniques: 20 MITRE STIX relationships reference this technique; 13 threat groups observed using it; 7 software families associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1003). Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- Carbanak
- MgBot
- Revenge RAT
- PinchDuke
- OnionDuke
- HOMEFRY
- Trojan.Karagany
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Ember Bear
- APT39
- Poseidon Group
- Mustang Panda
- Tonto Team
- APT32
- Suckfly
- BlackByte
- APT28
- Sowbug
- Storm-0501
- Axiom
Group associations are from MITRE ATT&CK STIX relationships.
References
- https://attack.mitre.org/techniques/T1003
- https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
- https://adsecurity.org/?p=1729
- https://msdn.microsoft.com/library/cc228086.aspx
- https://msdn.microsoft.com/library/cc237008.aspx
- https://msdn.microsoft.com/library/dd207691.aspx
- https://msdn.microsoft.com/library/cc245496.aspx
- https://github.com/mattifestation/PowerSploit
- https://wiki.samba.org/index.php/DRSUAPI
- http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my
- https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1003 OS Credential Dumping. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1003 OS Credential Dumping?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.