Cross-source coverage

T1003 / ATT&CK

OS Credential Dumping

372 rules · 364 families across 11 sources.

26 deprecated hidden · include 4 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

Tactics: Credential Access
Platforms: Linux · macOS · Windows
Telemetry: WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLmacos:unifiedlogmacos:keychainmacos:osquery

How MITRE says to detect it DET0234

Credential Dumping via Sensitive Memory and Registry Access Correlation

Windows Analytic 0648

Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.

WinEventLog:Sysmon EventCode=10
WinEventLog:Sysmon EventCode=1
WinEventLog:Security EventCode=4663, 4670, 4656
WinEventLog:Security EventCode=4662

Linux Analytic 0649

Processes opening /proc/*/mem or /proc/*/maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.

auditd:SYSCALL open
auditd:SYSCALL ptrace
auditd:SYSCALL execve

macOS Analytic 0650

Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.

macos:unifiedlog Code Execution & Entitlement Access
macos:keychain Access to Keychain DB or system.keychain
macos:osquery Invocation of osascript or dylib injection

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 372 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

146 rules

Detection	Severity	Format
Antivirus - Password Dumper Signature	Critical	Sigma
APT31 Judgement Panda Activity	Critical	Sigma
HackTool - Credential Dumping Tools Named Pipe Created	Critical	Sigma
HackTool - Dumpert Process Dumper Default File	Critical	Sigma
HackTool - Dumpert Process Dumper Execution	Critical	Sigma
HackTool - Inveigh Execution	Critical	Sigma
HackTool - QuarksPwDump Dump File	Critical	Sigma
HackTool - Rubeus Execution	Critical	Sigma
HackTool - SafetyKatz Execution	Critical	Sigma
NotPetya Ransomware Activity	Critical	Sigma

+ 136 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

66 rules

Detection	Severity	Format
Potential Invoke-Mimikatz PowerShell Script	Critical	Elastic TOML
Creation or Modification of Domain Backup DPAPI private key	High	Elastic TOML
Credential Acquisition via Registry Hive Dumping	High	Elastic TOML
Credential Dumping - Detected - Elastic Endgame	High	Elastic TOML
Disabling Lsa Protection via Registry Modification	High	Elastic TOML
Dumping Account Hashes via Built-In Commands	High	Elastic TOML
First Time Seen Account Performing DCSync	High	Elastic TOML
Kerberos Cached Credentials Dumping	High	Elastic TOML
Kirbi File Creation	High	Elastic TOML
Linux init (PID 1) Secret Dump via GDB	High	Elastic TOML

+ 56 more from elastic/detection-rules → showing the 10 highest-severity

socfortress/Wazuh-Rules

53 rules · 52 families

Detection	Severity	Format
Active Directory Replication from Non Machine Account	Critical	Wazuh XML
Powershell script: Credential dumping cmdlet detected	High	Wazuh XML
Powershell script: Credential theft cmdlet detected	High	Wazuh XML
Powershell script: Mimikatz keyword detected	High	Wazuh XML
Powershell script: SEKURLSA (Mimikatz module) detected	High	Wazuh XML
Powershell script: Suspicious process/DLL reference detected	High	Wazuh XML
Powershell script: Volume Shadow Copy access detected	High	Wazuh XML
Sysmon - Event 1: Process creation · Analyze LSASS Dump with mimikatz.exe (T1003.001)	High	Wazuh XML
Sysmon - Event 1: Process creation · Copy ntds.dit from VSC (T1003.003)	High	Wazuh XML
Sysmon - Event 1: Process creation · Copy SYSTEM hive from VSC (T1003.003)	High	Wazuh XML

+ 43 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

splunk/security_content

42 rules

Detection	Severity	Format
Access LSASS Memory for Dump Creation	Undefined	SPL
Attacker Tools On Endpoint	Undefined	SPL
Azure AD Privileged Authentication Administrator Role Assigned	Undefined	SPL
Azure AD Privileged Graph API Permission Assigned	Undefined	SPL
Cisco Secure Firewall - High Priority Intrusion Classification	Undefined	SPL
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity	Undefined	SPL
Create Remote Thread into LSASS	Undefined	SPL
Creation of lsass Dump with Taskmgr	Undefined	SPL
Creation of Shadow Copy	Undefined	SPL
Creation of Shadow Copy with wmic and powershell	Undefined	SPL

+ 32 more from splunk/security_content → showing the 10 highest-severity

elastic/protections-artifacts

26 rules

Detection	Severity	Format
Credential Access via Known Utilities	Undefined	Elastic TOML
Dumping Account Hashes via Built-In Commands	Undefined	Elastic TOML
Linux init (PID 1) Secret Dump via GDB	Undefined	Elastic TOML
LSA Dump via SilentProcessExit	Undefined	Elastic TOML
LSA Dump via Windows Error Reporting	Undefined	Elastic TOML
LSASS Access Attempt from an Unsigned Executable	Undefined	Elastic TOML
LSASS Access Attempt from Unbacked Memory	Undefined	Elastic TOML
LSASS Memory dump via MiniDumpWriteDump	Undefined	Elastic TOML
LSASS Memory Read via PPL Bypass	Undefined	Elastic TOML
Manual Memory Password Searching Activity	Undefined	Elastic TOML

+ 16 more from elastic/protections-artifacts → showing the 10 highest-severity

chronicle/detection-rules

21 rules

Detection	Severity	Format
hacktool_dumpert_process_dumper_default_file	Critical	YARA-L
hacktool_dumpert_process_dumper_exec	Critical	YARA-L
potential_cred_dumping_via_lsass_silentprocessexit_technique	Critical	YARA-L
rw_mimikatz_T1003	Critical	YARA-L
create_dump_process_dump	High	YARA-L
cred_dump_tools_dropped_files	High	YARA-L
credential_dumping_attempt_via_werfault	High	YARA-L
hacktool_generic_process_access	High	YARA-L
hacktool_mimikatz_execution	High	YARA-L
lsass_dump_keyword_command_line	High	YARA-L

+ 11 more from chronicle/detection-rules → showing the 10 highest-severity

Azure/Azure-Sentinel

7 rules

Detection	Severity	Format
Dev-0228 File Path Hashes November 2021	High	KQL
Dev-0228 File Path Hashes November 2021 (ASIM Version)	High	KQL
Europium - Hash and IP IOCs - September 2022	High	KQL
High volume LSASS memory read	Undefined	KQL
lsass-credential-dumping	Undefined	KQL
Process accessed LSASS from unbacked memory	Undefined	KQL
Suspicious LSASS access request by non-system account	Undefined	KQL

Wazuh Core Ruleset

4 rules

Detection	Severity	Format
Powershell used to copy SAM hive from VSS	Critical	Wazuh XML
Reg.exe used to dump SAM hive	Critical	Wazuh XML
Lsass process was accessed by with read permissions, possible credential dump · win.eventdata.targetImage = (?i)lsass\.exe, win.eventdata.grantedAccess = (?i)(0x1010\|0x40)	High	Wazuh XML
Suspicious Powershell activity with VSS and Windows SAM hive	Medium	Wazuh XML

panther-labs/panther-analysis

3 rules

Detection	Severity	Format
Crowdstrike Credential Dumping Tool	Critical	Panther Python
GAIA GCPW Credential Theft Attack Chain	High	Panther Python
Windows Credential Dumping Tool	High	Panther Python

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules

Detection	Severity	Format
MITRE ATT&CK Mapping	Undefined	KQL
NTDS.DIT File Modifications	Undefined	KQL

Emerging Threats Open

2 rules

Detection	Severity	Format
ET ATTACK_RESPONSE Windows 32bit procdump Dump File Exfiltration	High	Suricata
ET ATTACK_RESPONSE Windows 64bit procdump Dump File Exfiltration	High	Suricata