detecting-t1003-credential-dumping-with-edr

name	detecting-t1003-credential-dumping-with-edr
description	Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation. Use when detecting os credential dumping techniques targeting lsass memory, sam database,.
domain	cybersecurity
tags	["threat-hunting","credential-dumping","lsass","mitre-t1003","edr","mimikatz","ntds","sam-database"]
subdomain	threat-hunting
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Token Binding","Execution Isolation","File Metadata Consistency Validation","Restore Access","Application Protocol Command Analysis"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Detecting T1003 Credential Dumping With Edr

Overview

Cybersecurity skill for detecting t1003 credential dumping with edr. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting t1003 credential dumping with edr"

• "Detect OS credential dumping techniques targeting LSASS memory, SAM database, NT"

• When hunting for credential theft activity in the environment

• After compromise indicators suggest attacker has elevated privileges

• When EDR alerts fire for LSASS access or suspicious process memory reads

• During incident response to determine scope of credential compromise

• When auditing LSASS protection controls (Credential Guard, RunAsPPL)

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• EDR agent deployed with LSASS access monitoring (CrowdStrike, Defender for Endpoint, SentinelOne)
• Sysmon Event ID 10 (ProcessAccess) with LSASS-specific filters
• Windows Security Event ID 4656/4663 (Object Access Auditing)
• LSASS SACL auditing enabled (Windows 10+)
• Registry auditing for SAM hive access

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Define Detection Scope — Identify the specific t1003 credential dumping techniques or indicators to hunt. Map to MITRE ATT&CK tactics/techniques where applicable.