OS Credential Dumping
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
No parent-level observable remains that a sibling does not already occupy. AN0648's Windows leg is a Sysmon EventID 10 handle open against lsass.exe, which is published as T1003.001 — the drafted rule shared its logsource, its TargetImage pin and eight of nine GrantedAccess values, so shipping both raised two alerts under two technique IDs on every LSASS access. AN0648's Security 4663/4656 SAM-hive leg cannot be written against the file_event taxonomy the brief maps it onto, since 4663 carries ObjectName/ProcessName rather than TargetFilename. AN0649's /proc//mem leg is published as T1003.007. […]
What the technique is
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0648
Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.
- AN0649
Processes opening /proc/*/mem or /proc/*/maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.
- AN0650
Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.