H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Tool

gsecdump

[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)

Tool
TypeTool
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)

Labels

tool
8 recorded

Relationships

uses
from APT1
Group
uses
from BRONZE BUTLER
Group
uses
to LSA Secrets
Technique
uses
to Security Account Manager
Technique
uses
from Night Dragon
Campaign
uses
from PittyTiger
Group
uses
from Threat Group-3390
Group
uses
from Tonto Team
Group
2 external

References

mitre-attack
S0008
open
TrueSec Gsecdump
https://web.archive.org/web/20140328102838/https://www.truesec.se/sakerhet/verktyg/saakerhet/gsecdump_v2.0b5
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance