T1003

OS Credential Dumping

Index entry

In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.

View this technique on MITRE ATT&CK →

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

Linux audit framework (auditd)
- SYSCALL:execve SYSCALL record for execve
- SYSCALL:open SYSCALL record for open
- SYSCALL:ptrace SYSCALL record for ptrace
osquery (macOS) (the log as a whole)
Other macOS sources (fsevents, plists, launchd, TCC, MDM) (the log as a whole)
macOS unified log (the log as a whole)
Windows Security event log
- 4656 A handle to an object was requested.
- 4662 An operation was performed on an object.
- 4663 An attempt was made to access an object.
- 4670 Permissions on an object were changed.
Sysmon
- 1 Process creation
- 10 ProcessAccess

Practice it

2 scenarios in this catalog cover T1003. We don't name them, because identifying the technique is part of what a scenario grades. Explore the Range →