T1003 OS Credential Dumping — Detection & Response
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 4+
Threat context
How adversaries use T1003 OS Credential Dumping — Detection & Response
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
LSASS memory dumping (T1003.001) using Mimikatz, ProcDump, or Task Manager is the most common credential dumping technique in Windows environments. DCSync (T1003.006) is particularly dangerous: it allows an attacker with sufficient AD privileges to simulate a domain controller replication request, pulling NTLM hashes for all domain accounts without running code on a domain controller. This technique is used by ransomware groups and nation-state actors as a pre-lateral-movement step.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| LSASS Process Access — Suspicious process opens LSASS with PROCESS_VM_READ A non-system process accesses lsass.exe memory with read permissions, consistent with credential dumping. | Critical | CrowdStrike / Sysmon |
| DCSync Attack — Non-DC performing DS-Replication-Get-Changes-All A host that is not a domain controller requests Active Directory replication data, indicating a DCSync attack. | Critical | Active Directory / CrowdStrike |
| Mimikatz Signature — Known Mimikatz binary or in-memory strings detected Endpoint security agent detects Mimikatz binary, obfuscated variant, or in-memory strings associated with the tool. | Critical | CrowdStrike / SentinelOne |
| SAM Database Hive Accessed — Access to HKLM\SAM registry hive A process accesses the SAM registry hive, which contains local account password hashes. | High | Windows Event Log / Sysmon |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1003 OS Credential Dumping — Detection & Response: frequently asked questions
Does ManySignal correlate credential dump events with subsequent lateral movement?
Yes. When ManySignal detects a credential dump event (LSASS access, DCSync) on a host, it monitors subsequent lateral movement signals — PsExec, new network connections, WMI remote execution, and authentication events from other hosts — to reconstruct the attack chain.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.