Role
Incident response and threat hunting
Follow an alert to the actor behind it, with indicators, techniques and leaked access in one place, so a review starts from facts.
Read more
Attack technique
OS Credential Dumping
OS credential dumping is when an attacker pulls account login material out of a computer.
In short
OS credential dumping is when an attacker pulls account login material out of a computer. This is usually a password hash, sometimes a clear text password. The attacker can then use it to move to other systems and reach restricted information.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Credential Access · Step 9 Of 15 In The Attack Chain
- MITRE IDT1003ATT&CK technique
- Detection4ways to spot itDetection strategy MITRE lists
- Defences4ways to stop itProtect the login process · Harden authentication settings
How it works
Operating systems keep login material in several places, such as caches, memory and other internal structures. An attacker who gains enough rights on a system can read from these places and copy out the credentials they find.
MITRE groups this into eight sub-techniques, covering sources such as the LSASS process memory, the Security Account Manager, the domain database NTDS, LSA secrets, cached domain credentials, DCSync, the Linux proc filesystem and the Linux password files.
Stolen credentials can then be used for lateral movement. Using real credentials also makes the attacker harder to tell apart from a normal user. MITRE notes that some tools used for this are also used by professional security testers.
A real example
MITRE ATT&CK lists these procedure examples:
- Carbanak obtains Windows logon password details.
- HOMEFRY can perform credential dumping.
- MgBot includes modules for dumping and capturing credentials from process memory.
Who uses it
- Ransomware group BianLian BianLian is a ransomware and data extortion group that the FBI, CISA and Australia's ACSC say is likely based in Russia. Active · Since 2022 · Developer and deployer group with Russia-based affiliates
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Conti ransomware group Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK. Inactive · Since 2019 · Ransomware as a service, with a wage model per CISA
- Ransomware group Everest Everest is a financially motivated ransomware and data extortion group. Active · Since 2020 · Extortion group with ransomware and initial access broker activity
- Ransomware group Medusa Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Active · Since 2021 · Ransomware as a service (closed group until at least early 2023)
- Ransomware group Qilin Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Active · Since 2022 · Ransomware as a service
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
- Ransomware group Rhysida Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Active · Since 2023 · Ransomware as a service (profit-sharing with associates)
- Ransomware group Warlock Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers. Since 2025 · Not stated by the sources
Seen in incidents
- Incident Kyiv substation attack with Industroyer On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine. December 2016 · Energy and utilities
- Incident Microsoft Exchange ProxyLogon mass exploitation, 2021 The Microsoft Exchange ProxyLogon attacks of early 2021 used four previously unknown flaws in on-premises Exchange Server to reach email servers around the world. March 2021 · Multiple sectors
- Incident Poland energy sector attacks On 29 December 2025, coordinated destructive attacks hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company in Poland. December 2025 · Energy and utilities
- Incident SharePoint ToolShell attacks In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell. July 2025 · Multiple sectors
- Incident SingHealth patient database attack, 2018 Between August 2017 and July 2018 an attacker broke into the network of SingHealth, Singapore's largest public healthcare group, and copied the records of almost 1.5 million patients, mainly names, ID numbers, addresses and dates of birth. August 2017 to July 2018 · Healthcare
How to detect
-
Watch access to sensitive system memory and stores
Look for processes outside trusted security tools that open LSASS memory or read the SAM registry hives, especially when followed by file creation or lateral movement.
-
Watch process memory reads on Linux
Look for processes that read the memory or memory maps of services that hold credentials, such as login and remote access services, often alongside privilege escalation.
-
Watch Keychain and memory access on macOS
Look for unsigned processes that touch system memory or use scripting and injection to reach the Keychain or other sensitive memory.
-
Detection strategy MITRE lists
DET0234, Credential Dumping via Sensitive Memory and Registry Access Correlation.
How to defend
-
Protect the login process
Turn on Credential Guard and Protected Process Light for LSA where supported, and use attack surface reduction rules to protect LSASS. Credential Guard is not on by default and does not stop every form of credential dumping.
-
Harden authentication settings
Consider disabling or restricting NTLM and disabling WDigest. Add users to the Protected Users group to limit cached plaintext credentials.
-
Limit privileged accounts and reuse
Keep tight control of administrator accounts, use complex, unique local administrator passwords, and train staff not to reuse passwords. On Linux, reading passwords from memory needs root, so restrict privileged access.
-
Secure directory services
Control who holds replication permissions on domain controllers and keep domain controller backups properly secured.
Questions
What is OS credential dumping?
It is when an attacker pulls account login material, usually a password hash and sometimes a clear text password, out of a computer. They can then use it to move to other systems. MITRE ATT&CK tracks it as T1003 under Credential Access.
Where do attackers dump credentials from?
MITRE groups the technique into eight sub-techniques. The sources include LSASS process memory, the Security Account Manager, the NTDS domain database, LSA secrets, cached domain credentials, DCSync, the Linux proc filesystem and the Linux password files.
How can defenders detect credential dumping?
Look for processes outside trusted security tools that open LSASS memory or read the SAM registry hives, especially when followed by file creation or lateral movement. On Linux, watch for processes reading the memory of services that hold credentials.
How do you defend against OS credential dumping?
Turn on Credential Guard and Protected Process Light for LSA where supported, and consider disabling WDigest and restricting NTLM. Limit administrator accounts and use unique local administrator passwords. Credential Guard does not stop every form of dumping.
In our research
- GRU targeting of logistics firms: advisory AA25-141A October 2026
- Akira ransomware advisory AA24-109A: stages and tools October 2026
- Volt Typhoon advisory AA24-038A: what CISA says October 2026
- ATT&CK groups by attributed origin: what is mapped October 2026
- Why Ransomware Fragmentation Makes Attribution Harder Than Ever August 2026
- The Executive Cyber Threat: Personal Email, Home Networks, and Family Members as Attack Vectors July 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.