OS Credential Dumping `T1003`

Tactic: Credential Access

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Events covered

68 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 5	Process terminated
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 8	CreateRemoteThread
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4648	A logon was attempted using explicit credentials.
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4661	A handle to an object was requested.
Security-Auditing	Event ID 4662	An operation was performed on an object.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4672	Special privileges assigned to new logon.
Security-Auditing	Event ID 4673	A privileged service was called.
Security-Auditing	Event ID 4674	An operation was attempted on a privileged object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4689	A process has exited.
Security-Auditing	Event ID 4690	An attempt was made to duplicate a handle to an object.
Security-Auditing	Event ID 4692	Backup of data protection master key was attempted.
Security-Auditing	Event ID 4697	A service was installed in the system.
Security-Auditing	Event ID 4703	A user right was adjusted.
Security-Auditing	Event ID 4728	A member was added to a security-enabled global group.
Security-Auditing	Event ID 4732	A member was added to a security-enabled local group.
Security-Auditing	Event ID 4756	A member was added to a security-enabled universal group.
Security-Auditing	Event ID 4768	A Kerberos authentication ticket (TGT) was requested.
Security-Auditing	Event ID 4769	A Kerberos service ticket was requested.
Security-Auditing	Event ID 4904	An attempt was made to register a security event source.
Security-Auditing	Event ID 4905	An attempt was made to unregister a security event source.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5145	A network share object was checked to see whether client can be granted desired access.
Security-Auditing	Event ID 5382	Vault credentials were read.
Application-Error	Event ID 1000	Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.
Defender-DeviceEvents	OpenProcessApiCall	Process opened (OpenProcess API call)
Defender-DeviceEvents	ProcessPrimaryTokenModified	Process primary token modified
Defender-DeviceFileEvents	any	File activity
Defender-DeviceImageLoadEvents	any	Image load
Defender-DeviceNetworkEvents	any	Network activity
Defender-DeviceNetworkEvents	NetworkSignatureInspected	Network signature inspected
Defender-DeviceProcessEvents	any	Process activity
Defender-DeviceProcessEvents	ProcessCreated	Process created
Defender-IdentityLogonEvents	any	Identity logon activity
ESENT	Event ID 216	Event ID 216
ESENT	Event ID 325	Event ID 325
ESENT	Event ID 326	Event ID 326
ESENT	Event ID 327	Event ID 327
Linux-Auditd	Event ID 1124	USER_TTY
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1319	TTY
Linux-Auditd	Event ID 1327	PROCTITLE
Kernel-General	Event ID 16	The access history in hive HiveName was cleared updating KeysUpdated keys and creating DirtyPages modified pages.
Ntfs	Event ID 98	Volume DriveName (DeviceName) CorruptionActionState.
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
WER-SystemErrorReporting	Event ID 1001	The computer has rebooted from a bugcheck.
Windows-Defender	Event ID 1121	Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
PowerShell	Event ID 800	Event ID 800
Service-Control-Manager	Event ID 7045	A service was installed in the system.
Sysmon-for-Linux	Event ID 1	Process Create
VSSAudit	Event ID 8222	Event ID 8222

Authoring guide

These 423 rules share fields, values, and exclusions.

Fields filtered most (227 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	112	`contains` 80, `regex_match` 23, `wildcard` 7, `in` 5, `ends_with` 2, `match` 2, `eq` 1, `starts_with` 1	`--full` , `--name` , `-f` , `(?i)ntds\.dit`, `create`
`Image`	93	`ends_with` 64, `eq` 15, `starts_with` 10, `regex_match` 8, `contains` 7, `is_not_null` 5, `wildcard` 2	`?:\`, `\\lsass\.exe$`, `\mpcopyaccelerator.exe`, `\msmpeng.exe`, `\ntdsutil.exe`
`EventID`	80	`eq` 79, `in` 1	`4688`, `1`, `10`, `4104`, `4656`
`process_name`	77	`eq` 51, `ends_with` 10, `in` 9, `regex_match` 7, `contains` 3, `starts_with` 2, `is_not_null` 1, `ne` 1, `wildcard` 1	`cat`, `cmd.exe`, `powershell.exe`, `(?i)adexplorer(64)?\|adexp\.exe`, `\lsass.exe`
`OriginalFileName`	56	`eq` 54, `in` 2, `contains` 1, `is_null` 1	`powershell.exe`, `cmd.exe`, `reg.exe`, `appcmd.exe`, `dumpminitool.exe`
`host.os.type`	51	`eq` 51
`EventType`	45	`eq` 32, `in` 10, `ne` 2, `wildcard` 1	`exec`, `exec_event`, `ProcessRollup2`, `start`, `open`
`event.type`	43	`eq` 39, `in` 3, `ne` 1	`start`, `creation`, `change`, `process_started`, `deletion`
`TargetFilename`	33	`ends_with` 15, `contains` 10, `regex_match` 9, `wildcard` 4, `eq` 3, `starts_with` 3	`.dmp`, `?:\windows\system32\config\regback\sam`, `?:\windows\system32\config\regback\security`, `?:\windows\system32\config\regback\system`, `\.dmp$`
`TargetImage`	28	`ends_with` 23, `eq` 5	`\lsass.exe`, `lsass.exe`, `?:\windows\system32\lsass.exe`, `\\lsass.exe`, `c:\windows\system32\lsass.exe`
`process.args`	28	`eq` 22, `starts_with` 9, `wildcard` 8, `in` 5, `contains` 4, `match` 1, `ne` 1	`--pid`, `-p`, `1`, `-attach`, `-dump`
`TargetObject`	18	`contains` 7, `starts_with` 4, `eq` 3, `wildcard` 3, `ends_with` 2	`hklm\sam\sam\domains\account\`, `hklm\security\cache`, `hklm\security\policy\secrets\`, `\system\controlset\control\lsa\runasppl`, `\system\controlset\control\securityproviders\wdigest\u...`
`GrantedAccess`	17	`eq` 14, `ends_with` 5, `contains` 1, `in` 1, `starts_with` 1	`0x1010`, `0x1410`, `0x1fffff`, `0x1418`, `0x1438`
`ScriptBlockText`	16	`contains` 8, `in` 6, `eq` 3	`cert_system_store_local_machine`, `crypto::certificates`, `).create(`, `-dumpcr`, `[system.io.file]::copy`
`ParentImage`	15	`contains` 4, `ends_with` 4, `eq` 4, `regex_match` 3, `is_not_null` 1, `wildcard` 1	`\apache`, `\appdata\`, `%hacktool_contains`, `%hacktool_regex`, `.*`

Top indicator values (2949 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticCredential Access via TruffleHog Execution elasticCredential Acquisition via Registry Hive Dumping elasticDumping Account Hashes via Built-In Commands elasticLinux init (PID 1) Secret Dump via GDB elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticManual Memory Password Searching Activity elasticMicrosoft IIS Connection Strings Decryption elasticMicrosoft IIS Service Account Password Dumped elasticNTDS Dump via Wbadmin elasticNTDS or SAM Database File Copied elasticPotential Credential Access via Ptrace elasticPotential Credential Access via Renamed COM+ Services DLL elasticPotential Credential Access via Trusted Developer Utility +18 more rules	33	1078
`EventID`	`eq`	`4688` elasticPotential LSASS Clone Creation via PssCaptureSnapShot splunkADExplorer Execution (Windows Event Log) splunkADExplorer Snapshot Creation (Windows Event Log) splunkCommon LSASS Memory Dump Behavior (Windows Event Log) splunkcomsvcs.dll Lsass Memory Dump (Windows Event Log) splunkDump File Identified (Windows Event Log) splunkEsentutl Execution (Windows Event Log) splunkMimikatz (Windows Event Log) splunkMimikatz Execution (Windows Event Log) splunkMultiDump.exe Execution (Windows Event Log) splunkntds.dit Access from Unexpected Location (Windows Event Log) splunkntds.dit Command Line (Windows Event Log) splunkNTDSUtil.exe execution (Windows Event Log) splunkPossible Credential Dumping via Windows Network Providers (Windows Event Log) splunkpypykatz commands (Windows Event Log) +5 more rules	20	317
`EventID`	`eq`	`1` splunkADExplorer Execution (Sysmon) splunkADExplorer Snapshot Creation (Sysmon) splunkcomsvcs.dll Lsass Memory Dump (Sysmon) splunkEsentutl Execution (Sysmon) splunkMimikatz (Sysmon) splunkMultiDump.exe Execution (Sysmon) splunkntds.dit Access from Unexpected Location (Sysmon) splunkntds.dit Command Line (Sysmon) splunkNTDSUtil.exe execution (Sysmon) splunkRdrLeakDiag.exe Memory Dump (Sysmon) splunkSuspicious ntds.dit Commands (Sysmon) splunkWDigest Forced Credential Caching (Sysmon) kustoEuropium - Hash and IP IOCs - September 2022	13	241
`EventID`	`eq`	`10` elasticPotential Credential Access via DuplicateHandle in LSASS elasticPotential Credential Access via LSASS Memory Dump elasticSuspicious LSASS Access via MalSecLogon elasticSuspicious Lsass Process Access splunkAccess LSASS Memory for Dump Creation splunkDetect Credential Dumping through LSASS access splunkMimikatz (Sysmon) splunkWindows Hunting System Account Targeting Lsass splunkWindows Non-System Account Targeting Lsass splunkWindows Possible Credential Dumping kustoDumping LSASS Process Into a File	11	23
`EventID`	`eq`	`4104` splunkDetect Copy of ShadowCopy with Script Block Logging splunkDetect Mimikatz With PowerShell Script Block Logging splunkDump File Identified (PowerShell) splunkEsentutl Execution (PowerShell) splunkntds.dit Command Line (PowerShell) splunkPossible Credential Dumping via Windows Network Providers (PowerShell) splunkRdrLeakDiag.exe Memory Dump (PowerShell) splunkSuspicious ntds.dit Commands (PowerShell) splunkWDigest Forced Credential Caching (PowerShell) splunkWindows LAPS Password Gathering Via PowerShell Script	10	269
`EventID`	`eq`	`4656` splunkBrowser Credential File Accessed - Windows (Windows Event Log) splunkCommon LSASS Memory Dump Behavior (Windows Event Log) splunkLSASS Handle request (Windows Event Log) splunkMimikatz (Windows Event Log) splunkPotential Credential Dumping of LSASS (Windows Event Log) splunkPotential nanodump execution (Windows Event Log) splunkTask Manager lsass Dump (Windows Event Log)	7	19
`EventID`	`eq`	`4662` elasticAccess to a Sensitive LDAP Attribute splunkExcessive DRSGetNCChanges Requests (Windows Event Log) splunkPotential DCSync (Windows Event Log) splunkWindows AD Replication Request Initiated by User Account splunkWindows AD Replication Request Initiated from Unsanctioned Location kustoNon Domain Controller Active Directory Replication	6	15
`EventID`	`eq`	`4663` splunkBrowser Credential File Accessed - Windows (Windows Event Log) splunkPotential Credential Dumping of LSASS (Windows Event Log) splunkPotential nanodump execution (Windows Event Log) splunkSAM Database File Access Attempt splunkSAM, System, Security Files Accessed (Windows Event Log) splunkTask Manager lsass Dump (Windows Event Log)	6	35
`EventID`	`eq`	`4103` splunkDump File Identified (PowerShell) splunkEsentutl Execution (PowerShell) splunkntds.dit Command Line (PowerShell) splunkPossible Credential Dumping via Windows Network Providers (PowerShell) splunkRdrLeakDiag.exe Memory Dump (PowerShell)	5	105
`TargetImage`	`ends_with`	`\lsass.exe` sigmaCredential Dumping Activity By Python Based Tool sigmaCredential Dumping Attempt Via WerFault sigmaHackTool - HandleKatz Duplicating LSASS Handle sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaLsass Memory Dump via Comsvcs DLL sigmaPassword Dumper Remote Thread in LSASS sigmaPotential Credential Dumping Activity Via LSASS sigmaPotential Credential Dumping Attempt Via PowerShell sigmaPotential Credential Dumping Attempt Via PowerShell Remote Thread sigmaPotentially Suspicious GrantedAccess Flags On LSASS sigmaRemote LSASS Process Access Through Windows Remote Management sigmaSuspicious LSASS Access Via MalSecLogon sigmaSuspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs +1 more rules	16	16
`SubjectUserName`	`ends_with`	`$` sigmaActive Directory Replication from Non Machine Account - DcSync Indicator sigmaBackdoor introduction via registry permission change through WMI (DAMP) sigmaLSASS Access From Non System Account sigmaLSASS credential dump with LSASSY (kernel access) sigmaLSASS process dump by a non system account sigmaNetSYnc attack sigmaReplication privileges accessed to perform DCSync attack sigmaSAM database user credentials dump with Mimikatz sigmaSuspicious Machine Account Replication - DcSync Indicator splunkWindows AD Replication Request Initiated from Unsanctioned Location	10	5
`EventType`	`eq`	`exec` elasticLinux init (PID 1) Secret Dump via GDB elasticManual Memory Password Searching Activity elasticPotential Credential Access via Ptrace elasticPotential Linux Credential Dumping via Mimipenguin elasticPotential Linux Credential Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Unshadow elasticPotential Memory Dumping via dd elasticPotential Privilege Escalation via Linux DAC permissions elasticSuspicious Symbolic Link Created	9	576
`EventType`	`eq`	`start` elasticCredential Access via Known Utilities elasticLSA Dump via Windows Error Reporting elasticLSASS Access Attempt from an Unsigned Executable elasticLSASS Access Attempt from Unbacked Memory elasticPotential Credential Access via Mimikatz elasticSecurity Account Manager (SAM) Registry Access	6	391
`EventType`	`eq`	`open` elasticSecurity Account Manager (SAM) File Access elasticSensitive File Access by an Unsigned Process elasticSensitive Hive Access via Registry Backup elasticSensitive Registry Hive Access via RegBack elasticSuspicious Access to Active Directory Database File	5	52
`EventType`	`in`	`exec` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Unshadow elasticPotential Shadow File Read via Command Line Utilities elasticPotential Unauthorized Access via Wildcard Injection Detected elasticSuspicious /proc/maps Discovery elasticSuspicious Execution from Foomatic-rip or Cupsd Parent	9	201
`EventType`	`in`	`exec_event` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Unshadow elasticPotential Shadow File Read via Command Line Utilities elasticPotential Unauthorized Access via Wildcard Injection Detected elasticSuspicious /proc/maps Discovery elasticSuspicious Execution from Foomatic-rip or Cupsd Parent	9	149
`EventType`	`in`	`start` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Unshadow elasticPotential Unauthorized Access via Wildcard Injection Detected elasticSuspicious /proc/maps Discovery elasticSuspicious Execution from Foomatic-rip or Cupsd Parent	8	163
`EventType`	`in`	`ProcessRollup2` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Unshadow elasticPotential Unauthorized Access via Wildcard Injection Detected elasticSuspicious /proc/maps Discovery elasticSuspicious Execution from Foomatic-rip or Cupsd Parent	7	117
`event.category`	`eq`	`process` elasticPotential Invoke-Mimikatz PowerShell Script elasticPotential LSASS Memory Dump via PssCaptureSnapShot elasticPotential PowerShell HackTool Script by Function Names elasticPotential Privilege Escalation via Linux DAC permissions elasticPotential Shadow File Read via Command Line Utilities elasticPowerShell Invoke-NinjaCopy script elasticPowerShell Kerberos Ticket Dump elasticPowerShell MiniDump Script elasticPowerShell Script with Veeam Credential Access Capabilities	9	142
`CommandLine`	`contains`	`lsass` sigmaHackTool - HandleKatz LSASS Dumper Execution sigmaLSASS Dump Keyword In CommandLine sigmaPotential SysInternals ProcDump Evasion elasticCredential Access via Known Utilities kustoDopplePaymer Procdump kustoLSASS Credential Dumping with Procdump chronicleLSASS Dump Keyword In CommandLine	7	10
`CommandLine`	`contains`	`create` sigmaIFM creation detected from commandline (installation from media) sigmaShadow Copies Creation Using Operating Systems Utilities elasticCredential Access via Known Utilities splunkCreation of Shadow Copy splunkCreation of Shadow Copy with wmic and powershell splunkNtdsutil Export NTDS	6	29
`CommandLine`	`contains`	`.dmp` sigmaHackTool - HandleKatz LSASS Dumper Execution sigmaLSASS Dump Keyword In CommandLine sigmaRenamed CreateDump Utility Execution chronicleLSASS Dump Keyword In CommandLine chronicleRenamed CreateDump Utility Execution	5	10
`CommandLine`	`contains`	`\windows\ntds\ntds.dit` sigmaCopying Sensitive Files with Credential Data sigmaSensitive File Dump Via Print.EXE sigmaSensitive File Dump Via Wbadmin.EXE sigmaSensitive File Recovery From Backup Via Wbadmin.EXE sigmaSuspicious Process Patterns NTDS.DIT Exfil	5	5
`DeviceProduct`	`eq`	`X Series` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	6	7
`DeviceVendor`	`eq`	`Vectra Networks` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	6	7
`Image`	`ends_with`	`\rundll32.exe` sigmaDbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process sigmaLSASS credential dump with LSASSY (process) sigmaNotPetya Ransomware Activity sigmaNTDS.DIT Creation By Uncommon Process sigmaProcess Memory Dump Via Comsvcs.DLL sigmaSuspicious Renamed Comsvcs DLL Loaded By Rundll32	6	94
`MessageType`	`eq`	`2` kustoAlsid DCSync kustoAlsid LSASS Memory kustoTenable.ad DCSync kustoTenable.ad LSASS Memory kustoTIE DCSync kustoTIE LSASS Memory	6	21
`Properties`	`contains`	`1131f6aa-9c07-11d1-f79f-00c04fc2dcd2` sigmaActive Directory Replication from Non Machine Account - DcSync Indicator sigmaReplication privileges accessed to perform DCSync attack sigmaSuspicious Machine Account Replication - DcSync Indicator elasticFirst Time Seen Account Performing DCSync elasticPotential Credential Access via DCSync kustoNon Domain Controller Active Directory Replication	6	6
`Properties`	`contains`	`1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` sigmaActive Directory Replication from Non Machine Account - DcSync Indicator sigmaReplication privileges accessed to perform DCSync attack sigmaSuspicious Machine Account Replication - DcSync Indicator elasticFirst Time Seen Account Performing DCSync elasticPotential Credential Access via DCSync kustoNon Domain Controller Active Directory Replication	6	6
`Properties`	`contains`	`89e95b76-444d-4c62-991a-0facbeda640c` sigmaActive Directory Replication from Non Machine Account - DcSync Indicator sigmaReplication privileges accessed to perform DCSync attack sigmaSuspicious Machine Account Replication - DcSync Indicator elasticFirst Time Seen Account Performing DCSync elasticPotential Credential Access via DCSync kustoNon Domain Controller Active Directory Replication	6	6

Exclusions (798 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`SubjectUserName`	`ends_with`	`$` sigmaActive Directory Replication from Non Machine Account - DcSync Indicator sigmaBackdoor introduction via registry permission change through WMI (DAMP) sigmaLSASS Access From Non System Account sigmaLSASS credential dump with LSASSY (kernel access) sigmaLSASS process dump by a non system account sigmaNetSYnc attack sigmaReplication privileges accessed to perform DCSync attack sigmaSAM database user credentials dump with Mimikatz elasticFirst Time Seen Account Performing DCSync elasticPotential Credential Access via DCSync splunkWindows AD Replication Request Initiated by User Account	11
`process.code_signature.trusted`	`eq`	`true` elasticLSASS Memory Read via PPL Bypass elasticMemory Dump File with Unusual Extension elasticPotential Credential Access via Memory Dump File Creation elasticSecurity Account Manager (SAM) File Access elasticSecurity Account Manager (SAM) Registry Access elasticSensitive Hive Access via Registry Backup elasticSuspicious Access to Active Directory Database File elasticSuspicious Access to LSA Secrets Registry elasticSuspicious Registry Hive Dump	9
`Image`	`eq`	`?:\windows\system32\svchost.exe` elasticFull User-Mode Dumps Enabled System-Wide elasticLSASS Access Attempt from Unbacked Memory elasticModification of WDigest Security Provider elasticSystem BootKey Registry Access	4
`Image`	`eq`	`?:\windows\system32\werfault.exe` elasticLSASS Memory Dump Creation elasticLSASS Memory dump via MiniDumpWriteDump elasticPotential Credential Access via LSASS Memory Dump	3
`Image`	`eq`	`system` sigmaAccess To Browser Credential Files By Uncommon Applications sigmaAccess To Chromium Browsers Sensitive Files By Uncommon Applications sigmaAccess To Crypto Currency Wallets By Uncommon Applications	3
`Image`	`starts_with`	`c:\program files (x86)\` sigmaAccess To Browser Credential Files By Uncommon Applications sigmaAccess To Chromium Browsers Sensitive Files By Uncommon Applications sigmaAccess To Crypto Currency Wallets By Uncommon Applications sigmaCredential Manager Access By Uncommon Applications	4
`Image`	`starts_with`	`c:\program files\` sigmaAccess To Browser Credential Files By Uncommon Applications sigmaAccess To Chromium Browsers Sensitive Files By Uncommon Applications sigmaAccess To Crypto Currency Wallets By Uncommon Applications sigmaCredential Manager Access By Uncommon Applications	4
`Image`	`starts_with`	`c:\windows\system32\` sigmaAccess To Browser Credential Files By Uncommon Applications sigmaAccess To Chromium Browsers Sensitive Files By Uncommon Applications sigmaAccess To Crypto Currency Wallets By Uncommon Applications sigmaCredential Manager Access By Uncommon Applications	4
`Image`	`starts_with`	`c:\windows\syswow64\` sigmaAccess To Browser Credential Files By Uncommon Applications sigmaAccess To Chromium Browsers Sensitive Files By Uncommon Applications sigmaAccess To Crypto Currency Wallets By Uncommon Applications sigmaCredential Manager Access By Uncommon Applications	4
`Image`	`starts_with`	`c:\programdata\microsoft\windows defender\` sigmaAccess To Browser Credential Files By Uncommon Applications sigmaAccess To Chromium Browsers Sensitive Files By Uncommon Applications sigmaAccess To Crypto Currency Wallets By Uncommon Applications	3
`Image`	`wildcard`	`?:\program files (x86)\*.exe` elasticPotential Credential Access via Memory Dump File Creation elasticSecurity Account Manager (SAM) Registry Access elasticSuspicious Access to Active Directory Database File elasticSuspicious Access to LSA Secrets Registry	4
`Image`	`wildcard`	`?:\program files\*.exe` elasticPotential Credential Access via Memory Dump File Creation elasticSecurity Account Manager (SAM) Registry Access elasticSuspicious Access to Active Directory Database File elasticSuspicious Access to LSA Secrets Registry	4
`Image`	`wildcard`	`?:\windows\system32\lsass.exe` elasticSecurity Account Manager (SAM) File Access elasticSensitive Hive Access via Registry Backup elasticSuspicious Access to Active Directory Database File elasticSuspicious Access to LSA Secrets Registry	4
`Image`	`ends_with`	`\mpcopyaccelerator.exe` sigmaAccess To Browser Credential Files By Uncommon Applications sigmaAccess To Chromium Browsers Sensitive Files By Uncommon Applications sigmaAccess To Crypto Currency Wallets By Uncommon Applications	3
`Image`	`ends_with`	`\msmpeng.exe` sigmaAccess To Browser Credential Files By Uncommon Applications sigmaAccess To Chromium Browsers Sensitive Files By Uncommon Applications sigmaAccess To Crypto Currency Wallets By Uncommon Applications	3

OS Credential Dumping `T1003`

Events covered

Authoring guide

Fields filtered most (227 distinct)

Top indicator values (2949 distinct)

Exclusions (798 distinct)

Rules under this technique

Sigma 175 rules

Elastic 94 rules

Splunk 95 rules

Kusto 35 rules

YARA-L 21 rules

Panther 3 rules

OS Credential Dumping T1003

Events covered

Authoring guide

Fields filtered most (227 distinct)

Top indicator values (2949 distinct)

Exclusions (798 distinct)

Rules under this technique

Sigma 175 rules

Elastic 94 rules

Splunk 95 rules

Kusto 35 rules

YARA-L 21 rules

Panther 3 rules

OS Credential Dumping `T1003`