T1003 OS Credential Dumping
EnterpriseAdversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Plattformen
Plattformen, für die dies gilt.
Taktiken
ATT&CK-Taktiken, denen diese Technik dient.
Untertechniken (8)
Spezifischere Einträge unterhalb dieses.
Gegenmaßnahmen
ATT&CK-Gegenmaßnahmen, die dies verringern.
Erkannt durch (5)
Datenkomponenten, die dies erkennen.
NIST CSF 2.0 — Relevanzbereiche (Protect / Detect)
NIST-CSF-2.0-Bereiche mit dem größten Bezug (belegbasiert).
- PR.DSData Securitymoderat · gestützt durch 9 von 22 zugeordneten Controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderat · gestützt durch 8 von 22 zugeordneten Controls
- DE.CMContinuous Monitoringmoderat · gestützt durch 6 von 22 zugeordneten Controls
Abgeleitet aus MITRE CTID (Apache-2.0) und dem NIST-800-53-↔-CSF-Crosswalk (gemeinfrei). Eine indikative Relevanz entlang der Protect-/Detect-Achse — keine Compliance-Bewertung und keine Abdeckungsaussage.
Mindernde Maßnahmen (22)
Sicherheitskontrollen, die dies mindern.
bekannt ausgenutzte CVEs (18)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-32709US | —OT kritisch | KEV | ||
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-32756US | critical9.8OT kritisch | KEV | ||
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMa… | ||||
| CVE-2024-48248US | high8.6OT kritisch | KEV | ||
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the… | ||||
| CVE-2024-57727US | high7.5OT kritisch | KEV | ||
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary fil… | ||||
| CVE-2025-21335US | —OT kritisch | KEV | ||
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ||||
| CVE-2025-21334US | —OT kritisch | KEV | ||
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ||||
| CVE-2025-21333US | —OT kritisch | KEV | ||
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ||||
| CVE-2025-0282US | critical9.0OT kritisch | KEV | ||
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.… | ||||
| CVE-2024-4577US | critical9.8OT kritisch | KEV | ||
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows m… | ||||
| CVE-2023-28252US | —OT kritisch | KEV | ||
Windows Common Log File System Driver Elevation of Privilege Vulnerability | ||||
| CVE-2021-44515US | critical9.8OT kritisch | KEV | ||
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise… | ||||
| CVE-2021-44077US | critical9.8OT kritisch | KEV | ||
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. Thi… | ||||
| CVE-2021-40539US | critical9.8OT kritisch | KEV | ||
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. | ||||
| CVE-2021-22893US | critical10.0OT kritisch | KEV | ||
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration feature… | ||||
| CVE-2020-5902US | critical9.8OT kritisch | KEV | ||
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Co… | ||||
| CVE-2019-13608US | high7.5OT kritisch | KEV | ||
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. | ||||
| CVE-2019-11634US | critical9.8OT kritisch | KEV | ||
Citrix Workspace App before 1904 for Windows has Incorrect Access Control. | ||||
| CVE-2019-0604US | critical9.8OT kritisch | KEV | ||
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… | ||||
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
Gruppen (13)
Zugehörige Bedrohungsgruppen.
Software (7)
Zugehörige Malware und Tools.
Erkannt durch (Sigma) (37)
Zugehörige Sigma-Erkennungsregeln.
Quelle
Wo diese Definition veröffentlicht ist.