OS Credential Dumping

What is OS Credential Dumping?

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, and structures. Credentials can then be used to perform lateral movement and access restricted information. On Windows systems, the LSASS process stores credentials for logged-on users in memory, making it a prime target for credential dumping tools like Mimikatz. The Security Account Manager (SAM) database and Domain Controller NTDS.dit file contain password hashes for local and domain accounts respectively. Linux systems cache credentials in /etc/shadow and in memory via pluggable authentication module structures. Credential dumping is a critical capability for attackers because it allows them to move laterally using legitimate credentials, bypassing network segmentation and other controls that rely on authentication.

“OS Credential Dumping is documented as technique T1003 in the MITRE ATT&CK knowledge base under the Credential Access tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify OS Credential Dumping activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for process memory access to lsass.exe from unusual processes using Windows APIs like OpenProcess with PROCESS_VM_READ access rights, which is the primary method used by Mimikatz and similar tools.

2. 2

   Alert on the creation of LSASS memory dumps using tools like procdump, comsvcs.dll MiniDump, or direct volume shadow copy access to the NTDS.dit file on domain controllers.

3. 3

   Detect attempts to access the SAM registry hive directly using reg save commands or shadow copy techniques that bypass file locking on the SAM database file.

4. 4

   Monitor for execution of known credential dumping tools by file name, hash, and behavioral signature, including Mimikatz, LaZagne, Dumpert, and their renamed or recompiled variants.

5. 5

   Alert on unusual access patterns to /etc/shadow on Linux systems, LSASS process creation with non-standard parent processes, and DCSync replication requests from non-domain controller machines.

Example Alerts

These realistic alert examples show what OS Credential Dumping looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect OS Credential Dumping?

SOC analysts detect OS Credential Dumping (T1003) by monitoring XDR, SIEM telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor for process memory access to lsass.exe from unusual processes using windows apis like openprocess with process_vm_read access rights, which is. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect OS Credential Dumping?

OS Credential Dumping can be detected using XDR, SIEM platforms. XDR tools are particularly effective for this technique because they provide visibility into the credential access phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is OS Credential Dumping in real-world attacks?

OS Credential Dumping is a well-documented MITRE ATT&CK technique in the Credential Access tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic OS Credential Dumping scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting OS Credential Dumping for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Credential Access techniques like OS Credential Dumping. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.