T1003: OS Credential Dumping
Summary
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Source Attribution
Source: MITRE ATT&CK · Confidence: high
Platforms
- Linux
- macOS
- Windows
Tactic
credential-access
References
- https://attack.mitre.org/techniques/T1003
- https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
- https://adsecurity.org/?p=1729
- https://msdn.microsoft.com/library/cc228086.aspx
- https://msdn.microsoft.com/library/cc237008.aspx
- https://msdn.microsoft.com/library/dd207691.aspx
- https://msdn.microsoft.com/library/cc245496.aspx
- https://github.com/mattifestation/PowerSploit
- https://wiki.samba.org/index.php/DRSUAPI
- http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/
- https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf