{"T1003.001":"Chain with T1003.001 for deeper attack path","T1003.002":"Chain with T1003.002 for deeper attack path","T1003.003":"Chain with T1003.003 for deeper attack path"}
T1003 OS Credential Dumping
High-Level Description
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.
Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Kill Chain Phase
Credential Access (TA0006)
Platforms: Linux, macOS, Windows
What to Check
Identify if OS Credential Dumping technique is applicable to target environment
Check Linux systems for indicators of OS Credential Dumping
Check macOS systems for indicators of OS Credential Dumping
Check Windows systems for indicators of OS Credential Dumping
Verify mitigations are bypassed or absent (9 known mitigations)
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Gsecdump
Dump credentials from memory using Gsecdump.
Upon successful execution, you should see domain\username's followed by two 32 character hashes.
If you see output that says "compat: error: failed to create child process", execution was likely blocked by Anti-Virus.
You will receive only error output if you do not run this test from an elevated context (run as administrator)
If you see a message saying "The system cannot find the path specified", try using the get-prereq_commands to download and install Gsecdump first.
Supported Platforms: windows
Elevation Required: Yes
"#{gsecdump_exe}" -a
Dependencies:
Gsecdump must exist on disk at specified location (#{gsecdump_exe})
Atomic Test 2: Credential Dumping with NPPSpy
Changes ProviderOrder Registry Key Parameter and creates Key for NPPSpy.
After user's logging in cleartext password is saved in C:\NPPSpy.txt.
Clean up deletes the files and reverses Registry changes.
NPPSpy Source:
Atomic Test 4: Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using list)
AppCmd.exe is a command line utility which is used for managing an IIS web server. The list command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes.
Reference
Supported Platforms: windows
Elevation Required: Yes
C:\Windows\System32\inetsrv\appcmd.exe list apppool /@t:*
C:\Windows\System32\inetsrv\appcmd.exe list apppool /@text:*
C:\Windows\System32\inetsrv\appcmd.exe list apppool /text:*
Dependencies:
IIS must be installed prior to running the test
Atomic Test 5: Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using config)
AppCmd.exe is a command line utility which is used for managing an IIS web server. The config command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes.
Reference
Supported Platforms: windows
Elevation Required: Yes
C:\Windows\System32\inetsrv\appcmd.exe list apppool /config
Dependencies:
IIS must be installed prior to running the test
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to OS Credential Dumping by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
M1041 Encrypt Sensitive Information
Ensure Domain Controller backups are properly secured.
M1040 Behavior Prevention on Endpoint
On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.
M1027 Password Policies
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
M1017 User Training
Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
M1026 Privileged Account Management
Windows:
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
Linux:
Scraping the passwords from memory requires root privileges. Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive regions of memory.
M1025 Privileged Process Integrity
On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.
M1043 Credential Access Protection
With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.
M1015 Active Directory Configuration
Manage the access control list for “Replicating Directory Changes All” and other permissions associated with domain controller replication. Consider adding users to the "Protected Users" Active Directory security group. This can help limit the caching of users' plaintext credentials.
M1028 Operating System Configuration
Consider disabling or restricting NTLM. Consider disabling WDigest authentication.
Detection
Credential Dumping via Sensitive Memory and Registry Access Correlation
