OS Credential Dumping

What is OS Credential Dumping?

“OS Credential Dumping is documented as technique T1003 in MITRE ATT&CK® v19.1 under the Credential Access tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify OS Credential Dumping activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for process memory access to lsass.exe from unusual processes using Windows APIs like OpenProcess with PROCESS_VM_READ access rights, which is the primary method used by Mimikatz and similar tools.

2. 2

   Alert on the creation of LSASS memory dumps using tools like procdump, comsvcs.dll MiniDump, or direct volume shadow copy access to the NTDS.dit file on domain controllers.

3. 3

   Detect attempts to access the SAM registry hive directly using reg save commands or shadow copy techniques that bypass file locking on the SAM database file.

4. 4

   Monitor for execution of known credential dumping tools by file name, hash, and behavioral signature, including Mimikatz, LaZagne, Dumpert, and their renamed or recompiled variants.

5. 5

   Alert on unusual access patterns to /etc/shadow on Linux systems, LSASS process creation with non-standard parent processes, and DCSync replication requests from non-domain controller machines.

Example Alerts

These realistic alert examples show what OS Credential Dumping looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect OS Credential Dumping?

Detection centers on XDR, SIEM telemetry for the credential access phase of the attack. Monitor for process memory access to lsass.exe from unusual processes using Windows APIs like OpenProcess with PROCESS_VM_READ access rights, which is the primary method used by Mimikatz and similar tools. Alert on the creation of LSASS memory dumps using tools like procdump, comsvcs.dll MiniDump, or direct volume shadow copy access to the NTDS.dit file on domain controllers.

What does a OS Credential Dumping alert look like?

A representative XDR detection is "LSASS Memory Access by Suspicious Process" (critical severity): Process "c:\users\temp\update.exe" attempted to open LSASS.exe memory with PROCESS_VM_READ and PROCESS_QUERY_INFORMATION access flags. This behavior is characteristic of credential dumping tools attempting to extract cached credentials from the Windows LSASS process. The accessing process has no legitimate reason to read LSASS memory and matches behavioral signatures of Mimikatz.

Which tools detect OS Credential Dumping, and how can I practice?

OS Credential Dumping (T1003) is best surfaced with XDR, SIEM telemetry, which exposes the credential access signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.