Technique:  OS Credential Dumping:LSASS Memory
During the 2016 Ukraine Electric Power Attack, It used Mimikatz to capture and use legitimate credentials.
It has been known to use credential dumping using Mimikatz.
It regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.
It has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."
It used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.
It has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.
It has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.
It has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
It has attempted to harvest credentials through LSASS memory dumping.
Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.
It has used Mimikatz to retrieve credentials from LSASS memory.
It has used various tools (such as Mimikatz and WCE) to perform credential dumping.
It has been known to dump credentials using Mimikatz and Windows Credential Editor.
Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.
CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.
Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.
It has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.
Emotet has been observed dropping password grabber modules including Mimikatz.
Empire contains an implementation of Mimikatz to gather credentials from memory.
It has obtained memory dumps with ProcDump to parse and extract credentials from a victim's LSASS process memory with Mimikatz.
It has used Windows Credential Editor for credential dumping.
It harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).
It has used prodump to dump credentials from LSASS.
It used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.
GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.
It has used procdump to dump the LSASS process memory.
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
It used Cobalt Strike to carry out credential dumping using ProcDump.
It has dumped credentials, including by using Mimikatz.
It has gathered credentials using Mimikatz and ProcDump.
LaZagne can perform credential dumping from memory to obtain account and password information.
It used several tools for retrieving login and password information, including LaZagne and Mimikatz.
It has used publicly available tools to dump password hashes, including ProcDump and WCE.
Lizar can run Mimikatz to harvest credentials.
Lslsass can dump active logon session password hashes from the lsass process.
Mafalda can dump password hashes from LSASS.exe.
It has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.
It has performed credential dumping with Mimikatz and procdump64.exe.
Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.
NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.
It has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Okrum was seen using MimikatzLite to perform credential dumping.
Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.
During Operation Wocao, threat actors used ProcDump to dump credentials from memory.
It has used keyloggers that are also capable of dumping credentials.
PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.
PoshC2 contains an implementation of Mimikatz to gather credentials from memory.
PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.
Pupy can execute Lazagne as well as Mimikatz using PowerShell.
Pysa can perform OS credential dumping using Mimikatz.
It has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.
It has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.
SILENTTRINITY can create a memory dump of LSASS via the MiniDumpWriteDump Win32 API call.
It has used Mimikatz and a custom tool, SecHack, to harvest credentials.
It actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.
It has attempted to access hashed credentials from the LSASS process memory space.
It has used Mimikatz to obtain credentials.
Windows Credential Editor can dump credentials.
It has dumped the lsass.exe memory to harvest credentials with the use of open-source tool LaZagne.