H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

OS Credential Dumping

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

38 recorded

Relationships

mapped-to
from Collect Data from Common Resource Locations
Technique
mitigates
from Active Directory Configuration
Mitigation
mitigates
from Behavior Prevention on Endpoint
Mitigation
mitigates
from Credential Access Protection
Mitigation
mitigates
from Encrypt Sensitive Information
Mitigation
mitigates
from Operating System Configuration
Mitigation
mitigates
from Password Policies
Mitigation
mitigates
from Privileged Account Management
Mitigation
mitigates
from Privileged Process Integrity
Mitigation
mitigates
from User Training
Mitigation
subtechnique-of
from Cached Domain Credentials
Technique
subtechnique-of
from DCSync
Technique
subtechnique-of
from /etc/passwd and /etc/shadow
Technique
subtechnique-of
from LSA Secrets
Technique
subtechnique-of
from LSASS Memory
Technique
subtechnique-of
from NTDS
Technique
subtechnique-of
from Proc Filesystem
Technique
subtechnique-of
from Security Account Manager
Technique
uses
from APT28
Group
uses
from APT32
Group
uses
from APT39
Group
uses
from Axiom
Group
uses
from BlackByte
Group
uses
from Carbanak
Malware
uses
from Ember Bear
Group
uses
from HOMEFRY
Malware
uses
from Leviathan
Group
uses
from MgBot
Malware
uses
from Mustang Panda
Group
uses
from OnionDuke
Malware
uses
from PinchDuke
Malware
uses
from Poseidon Group
Group
uses
from Revenge RAT
Malware
uses
from Sowbug
Group
uses
from Storm-0501
Group
uses
from Suckfly
Group
uses
from Tonto Team
Group
uses
from Trojan.Karagany
Malware
11 external

References

mitre-attack
T1003
open
Medium Detecting Attempts to Steal Passwords from Memory
https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
open
AdSecurity DCSync Sept 2015
https://adsecurity.org/?p=1729
open
Microsoft DRSR Dec 2017
https://msdn.microsoft.com/library/cc228086.aspx
open
Microsoft NRPC Dec 2017
https://msdn.microsoft.com/library/cc237008.aspx
open
Microsoft GetNCCChanges
https://msdn.microsoft.com/library/dd207691.aspx
open
Microsoft SAMR
https://msdn.microsoft.com/library/cc245496.aspx
open
Powersploit
https://github.com/mattifestation/PowerSploit
open
Samba DRSUAPI
https://wiki.samba.org/index.php/DRSUAPI
open
Harmj0y DCSync Sept 2015
http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/
open
Brining MimiKatz to Unix
https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance