OS Credential Dumping
Description
Adversaries may extract credentials from OS caches, application memory, or other sources on a compromised system. Credentials are often in the form of a hash or clear text, and can include usernames and passwords, application tokens, or other authentication keys.
Credentials can be used to perform Lateral Movement to access other AI services such as AI agents, LLMs, or AI inference APIs. Credentials could also give an adversary access to other software tools and data sources that are part of the AI DevOps lifecycle.
- ATLAS ID
- AML.T0090
- Maturity
- DemonstratedShown to work in research or red-team exercises.
- Platforms
- Enterprise
Mitigations
- AML.M0011Restrict Library Loading
Restrict library loading to block credential-dumping paths that inject or load malicious code into processes holding authentication material.
Case studies that use it
Related ATT&CK technique
ATLAS adapts this technique from MITRE ATT&CK Enterprise.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ANAAAdministrative Network Activity Analysis1 shared
- D3-WSAMWeb Session Access Mediation1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-SFASystem File Analysis1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2019-04-004Credential Dumping via Mimikatz1 shared
- CAR-2019-07-002Lsass Process Dump via Procdump1 shared
- CAR-2019-08-001Credential Dumping via Windows Task Manager1 shared
- CAR-2019-08-002Active Directory Dumping via NTDSUtil1 shared
- CAR-2020-05-001MiniDump of LSASS1 shared
- CAR-2021-05-011Create Remote Thread into LSASS1 shared
- CAR-2013-07-001Suspicious Arguments1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared