T1003 OS Credential Dumping
EnterpriseAdversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (8)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.DSData Securitymoderate · backed by 9 of 22 mapped controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 8 of 22 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 6 of 22 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (22)
Security controls that mitigate this.
known-exploited CVEs (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-32709US | —OT critical | KEV | ||
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-32756US | critical9.8OT critical | KEV | ||
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMa… | ||||
| CVE-2024-48248US | high8.6OT critical | KEV | ||
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the… | ||||
| CVE-2024-57727US | high7.5OT critical | KEV | ||
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary fil… | ||||
| CVE-2025-21335US | —OT critical | KEV | ||
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ||||
| CVE-2025-21334US | —OT critical | KEV | ||
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ||||
| CVE-2025-21333US | —OT critical | KEV | ||
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ||||
| CVE-2025-0282US | critical9.0OT critical | KEV | ||
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.… | ||||
| CVE-2024-4577US | critical9.8OT critical | KEV | ||
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows m… | ||||
| CVE-2023-28252US | —OT critical | KEV | ||
Windows Common Log File System Driver Elevation of Privilege Vulnerability | ||||
| CVE-2021-44515US | critical9.8OT critical | KEV | ||
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise… | ||||
| CVE-2021-44077US | critical9.8OT critical | KEV | ||
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. Thi… | ||||
| CVE-2021-40539US | critical9.8OT critical | KEV | ||
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. | ||||
| CVE-2021-22893US | critical10.0OT critical | KEV | ||
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration feature… | ||||
| CVE-2020-5902US | critical9.8OT critical | KEV | ||
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Co… | ||||
| CVE-2019-13608US | high7.5OT critical | KEV | ||
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. | ||||
| CVE-2019-11634US | critical9.8OT critical | KEV | ||
Citrix Workspace App before 1904 for Windows has Incorrect Access Control. | ||||
| CVE-2019-0604US | critical9.8OT critical | KEV | ||
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… | ||||
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (13)
Threat groups associated with this.
software (7)
Malware and tools associated with this.
Detected by (Sigma) (37)
Sigma detection rules related to this.
source
Where this definition is published.