detection.wiki

OS Credential Dumping T1003

Tactic: Credential Access

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Events covered

68 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 5Process terminated
SysmonEvent ID 7Image loaded
SysmonEvent ID 8CreateRemoteThread
SysmonEvent ID 10ProcessAccess
SysmonEvent ID 11FileCreate
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)
SysmonEvent ID 17PipeEvent (Pipe Created)
SysmonEvent ID 18PipeEvent (Pipe Connected)
SysmonEvent ID 23FileDelete (File Delete archived)
SysmonEvent ID 26FileDeleteDetected (File Delete logged)
Security-AuditingEvent ID 4624An account was successfully logged on.
Security-AuditingEvent ID 4648A logon was attempted using explicit credentials.
Security-AuditingEvent ID 4656A handle to an object was requested.
Security-AuditingEvent ID 4657A registry value was modified.
Security-AuditingEvent ID 4661A handle to an object was requested.
Security-AuditingEvent ID 4662An operation was performed on an object.
Security-AuditingEvent ID 4663An attempt was made to access an object.
Security-AuditingEvent ID 4672Special privileges assigned to new logon.
Security-AuditingEvent ID 4673A privileged service was called.
Security-AuditingEvent ID 4674An operation was attempted on a privileged object.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4689A process has exited.
Security-AuditingEvent ID 4690An attempt was made to duplicate a handle to an object.
Security-AuditingEvent ID 4692Backup of data protection master key was attempted.
Security-AuditingEvent ID 4697A service was installed in the system.
Security-AuditingEvent ID 4703A user right was adjusted.
Security-AuditingEvent ID 4728A member was added to a security-enabled global group.
Security-AuditingEvent ID 4732A member was added to a security-enabled local group.
Security-AuditingEvent ID 4756A member was added to a security-enabled universal group.
Security-AuditingEvent ID 4768A Kerberos authentication ticket (TGT) was requested.
Security-AuditingEvent ID 4769A Kerberos service ticket was requested.
Security-AuditingEvent ID 4904An attempt was made to register a security event source.
Security-AuditingEvent ID 4905An attempt was made to unregister a security event source.
Security-AuditingEvent ID 5136A directory service object was modified.
Security-AuditingEvent ID 5145A network share object was checked to see whether client can be granted desired access.
Security-AuditingEvent ID 5382Vault credentials were read.
Application-ErrorEvent ID 1000Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.
Defender-DeviceEventsOpenProcessApiCallProcess opened (OpenProcess API call)
Defender-DeviceEventsProcessPrimaryTokenModifiedProcess primary token modified
Defender-DeviceFileEventsanyFile activity
Defender-DeviceImageLoadEventsanyImage load
Defender-DeviceNetworkEventsanyNetwork activity
Defender-DeviceNetworkEventsNetworkSignatureInspectedNetwork signature inspected
Defender-DeviceProcessEventsanyProcess activity
Defender-DeviceProcessEventsProcessCreatedProcess created
Defender-IdentityLogonEventsanyIdentity logon activity
ESENTEvent ID 216Event ID 216
ESENTEvent ID 325Event ID 325
ESENTEvent ID 326Event ID 326
ESENTEvent ID 327Event ID 327
Linux-AuditdEvent ID 1124USER_TTY
Linux-AuditdEvent ID 1302PATH
Linux-AuditdEvent ID 1319TTY
Linux-AuditdEvent ID 1327PROCTITLE
Kernel-GeneralEvent ID 16The access history in hive HiveName was cleared updating KeysUpdated keys and creating DirtyPages modified pages.
NtfsEvent ID 98Volume DriveName (DeviceName) CorruptionActionState.
PowerShellEvent ID 4103Payload Context: ContextInfo User Data: UserData.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
WER-SystemErrorReportingEvent ID 1001The computer has rebooted from a bugcheck.
Windows-DefenderEvent ID 1121Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
PowerShellEvent ID 800Event ID 800
Service-Control-ManagerEvent ID 7045A service was installed in the system.
Sysmon-for-LinuxEvent ID 1Process Create
VSSAuditEvent ID 8222Event ID 8222

Authoring guide

These 426 rules share fields, values, and exclusions.

Fields filtered most (202 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CommandLine114contains 81, regex_match 23, wildcard 8, in 5, ends_with 2, match 2, eq 1, starts_with 1 --full , --name , -f , (?i)ntds\.dit, -ma
Image93ends_with 64, eq 15, starts_with 10, regex_match 8, contains 7, is_not_null 5, wildcard 2, C:\Program Files (x86)\, C:\Program Files\, ?:\*, C:\ProgramData\Microsoft\Windows Defender\
EventID81eq 80, in 14688, 1, 10, 4104, 4656
process_basename62eq 50, in 11, contains 1, is_not_null 1, starts_with 1cat, reg.exe, cmd.exe, gdb, powershell.exe
OriginalFileName55eq 53, in 2, contains 1, is_null 1PowerShell.EXE, Cmd.Exe, FX_VER_INTERNALNAME_STR, RUNDLL32.EXE, reg.exe
EventType47eq 34, in 10, ne 2, wildcard 1exec, exec_event, ProcessRollup2, start, open
event.type45eq 41, in 3, ne 1start, creation, change, process_started, deletion
TargetFilename33ends_with 15, contains 10, regex_match 9, wildcard 4, eq 3, starts_with 3.dmp, \lsass, .DMP, ?:\Windows\System32\config\RegBack\SAM, ?:\Windows\System32\config\RegBack\SECURITY
process.args29eq 22, starts_with 10, wildcard 8, in 6, contains 4, match 1, ne 1--pid, -p, 1, -attach, -dump
TargetImage28ends_with 23, eq 5\lsass.exe, *lsass.exe, ?:\WINDOWS\system32\lsass.exe, *\\lsass.exe, *\lsass.exe
process_name20ends_with 10, regex_match 7, contains 3, eq 3, ne 1, starts_with 1, wildcard 1(?i)ADExplorer(64)?|AdExp\.exe, \lsass.exe, (?i)\x5c(apache|tomcat|AppData|Temp|PerfLogs|Public|Downl..., :\Program Files (x86)\, :\Program Files\
TargetObject18contains 7, starts_with 4, eq 3, wildcard 3, ends_with 2HKLM\SAM\SAM\Domains\Account\*, HKLM\SECURITY\CACHE*, HKLM\SECURITY\Policy\Secrets\*, *\SYSTEM\*ControlSet*\Control\Lsa\RunAsPPL, *\SYSTEM\*ControlSet*\Control\SecurityProviders\WDigest\U...
GrantedAccess17eq 14, ends_with 5, contains 1, in 1, starts_with 10x1010, 0x1410, 0x1FFFFF, 0x1418, 0x1438
ScriptBlockText17contains 8, in 7, eq 3*-dumpcr*, CERT_SYSTEM_STORE_LOCAL_MACHINE, DumpCerts, DumpCreds, ).Create(
ParentImage15contains 4, ends_with 4, eq 4, regex_match 3, is_not_null 1, wildcard 1\AppData\, \PerfLogs\, \Public\, , %hacktool_contains

Top indicator values (3260 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
331036
EventIDeq
4688
19284
EventIDeq
1
12226
EventIDeq
4104
11269
EventIDeq
4656
715
EventIDeq
10
616
EventIDeq
4663
631
EventIDeq
10
57
EventIDeq
4103
5105
TargetImageends_with
*\lsass.exe
1717
EventTypeeq
exec
10547
EventTypeeq
start
6388
EventTypeeq
open
549
SubjectUserNameends_with
$
105
event.categoryeq
process
9105
EventTypein
exec
8180
EventTypein
exec_event
8135
EventTypein
start
8157
EventTypein
ProcessRollup2
7119
EventTypein
executed
585
EventTypein
process_started
577
CommandLinecontains
*create*
629
CommandLinecontains
\Windows\NTDS\NTDS.dit
55
DeviceProducteq
X Series
67
DeviceVendoreq
Vectra Networks
67
Imageends_with
\rundll32.exe
694
MessageTypeeq
2
621
GrantedAccesseq
0x1FFFFF
59
Imageis_not_null
5155
Propertiescontains
*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*
55

Exclusions (806 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
SubjectUserNameends_with
$
11
process.code_signature.trustedeq
true
9
Imageeq
?:\Windows\System32\svchost.exe
4
Imageeq
?:\Windows\System32\WerFault.exe
3
Imageeq
System
3
Imagestarts_with
C:\Program Files (x86)\
4
Imagestarts_with
C:\Program Files\
4
Imagestarts_with
C:\Windows\SysWOW64\
4
Imagestarts_with
C:\Windows\system32\
4
Imagestarts_with
C:\ProgramData\Microsoft\Windows Defender\
3
Imagewildcard
?:\Program Files (x86)\*.exe
4
Imagewildcard
?:\Program Files\*.exe
4
Imagewildcard
?:\Windows\System32\lsass.exe
4
Imageends_with
\MpCopyAccelerator.exe
3
Imageends_with
\MsMpEng.exe
3

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 175 rules

Elastic 96 rules

Splunk 96 rules

Kusto 35 rules

YARA-L 21 rules

Panther 3 rules