sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
During Operation Wocao, threat actors encrypted IP addresses used for "Agent" proxy hops with RC4.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
FRAMESTING can send and receive zlib compressed data within `POST` requests.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
FlawedAmmyy may obfuscate portions of the initial C2 handshake.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
FunnyDream can send compressed and obfuscated packets to C2.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
Ninja has the ability to modify headers and URL paths to hide malicious traffic in HTTP requests.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
SideTwist can embed C2 responses in the source code of a fake Flickr webpage.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.
Technique: T1001 Data Obfuscation, Tactic: TA0011 Command and Control
APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
BendyBear has used byte randomization to obscure its behavior.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
GrimAgent  can pad C2 messages with random generated values.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
Mori has obfuscated the FML.dll with 200MB of junk data.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
P2P ZeuS added junk data to outgoing UDP packets to peer implants.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
P8RAT can send randomly-generated data as part of its C2 communication.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
PLEAD samples were found to be highly obfuscated with junk code.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
SUNBURST added junk bytes to its C2 over HTTP.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
Turian can insert pseudo-random characters into its network encryption setup.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
Uroburos can add extra characters in encoded strings to help mimic DNS legitimate requests.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
WellMess can use junk data in the Base64 string for additional obfuscation.
Technique: T1001.001 Data Obfuscation: Junk Data, Tactic: TA0011 Command and Control
During Operation Ghost, APT29 used steganography to hide the communications between the implants and their C&C servers.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
Axiom has used steganography to hide its C2 communications.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
Daserf can use steganography to hide malicious code downloaded to the victim.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
HAMMERTOSS is controlled via commands that are appended to image files.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
RDAT can process steganographic images attached to email messages to send and receive C2 commands. RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
Sliver can encode binary data into a .PNG file for C2 communication.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit (LSB) steganography.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
Zox has used the .PNG file format for C2 communications.
Technique: T1001.002 Data Obfuscation: Steganography, Tactic: TA0011 Command and Control
During C0017, APT41 frequently configured the URL endpoints of their stealthy passive backdoor LOWKEY.PASSIVE to masquerade as normal web application traffic on an infected server.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
Higaisa used a FakeTLS session for C2 communications.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
BADCALL uses a FakeTLS method during C2.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
Cobalt Strike can mimic the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
FRAMESTING uses a cookie named `DSID` to mimic the name of a cookie used by Ivanti Connect Secure appliances for maintaining VPN sessions.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
HARDRAIN uses FakeTLS to communicate with its C2 server.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
Ninja has the ability to mimic legitimate services with customized HTTP URL paths and headers to hide malicious traffic.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
TAINTEDSCRIBE has used FakeTLS for session authentication.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
Uroburos can use custom communication methodologies that ride over common  protocols including TCP, UDP, HTTP, SMTP, and DNS in order to blend with normal network traffic.
Technique: T1001.003 Data Obfuscation: Protocol Impersonation, Tactic: TA0011 Command and Control
APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
APT32 used GetPassword_x64 to harvest credentials.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
APT39 has used different versions of Mimikatz to obtain credentials.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
Axiom has been known to dump credentials.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
Sowbug has used credential dumping tools.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
Suckfly used a signed credential-dumping tool to obtain victim account credentials.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
Tonto Team has used a variety of credential dumping tools.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
Carbanak obtains Windows logon password details.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
HOMEFRY can perform credential dumping.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
OnionDuke steals credentials from its victims.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
Revenge RAT has a plugin for credential harvesting.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
Trojan.Karagany can dump passwords and save them into `\ProgramData\Mail\MailAg\pwds.txt`.
Technique: T1003 OS Credential Dumping, Tactic: TA0006 Credential Access
During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
During the C0032 campaign, TEMP.Veles used Mimikatz and a custom tool, SecHack, to harvest credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
During Cutting Edge, threat actors used Task Manager to dump LSASS memory from Windows devices to disk.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
During Operation Wocao, threat actors used ProcDump to dump credentials from memory.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
In the Triton Safety Instrumented System Attack, TEMP.Veles used Mimikatz.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
APT1 has been known to use credential dumping using Mimikatz.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
APT5 has used the Task Manager process to target LSASS process memory in order to obtain NTLM password hashes. APT5 has also dumped clear text passwords and hashes from memory using Mimikatz hosted through an RDP mapped drive.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
FIN13 has obtained memory dumps with ProcDump to parse and extract credentials from a victim's LSASS process memory with Mimikatz.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
FIN6 has used Windows Credential Editor for credential dumping.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Fox Kitten has used prodump to dump credentials from LSASS.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
HAFNIUM has used `procdump` to dump the LSASS process memory.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Ke3chang has dumped credentials, including by using Mimikatz.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Kimsuky has gathered credentials using Mimikatz and ProcDump.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
PLATINUM has used keyloggers that are also capable of dumping credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Volt Typhoon has attempted to access hashed credentials from the LSASS process memory space.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Whitefly has used Mimikatz to obtain credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Wizard Spider has dumped the lsass.exe memory to harvest credentials with the use of open-source tool LaZagne.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Emotet has been observed dropping password grabber modules including Mimikatz.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Empire contains an implementation of Mimikatz to gather credentials from memory.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
LaZagne can perform credential dumping from memory to obtain account and password information.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Lizar can run Mimikatz to harvest credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Lslsass can dump active logon session password hashes from the lsass process.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Mafalda can dump password hashes from `LSASS.exe`.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Okrum was seen using MimikatzLite to perform credential dumping.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
PoshC2 contains an implementation of Mimikatz to gather credentials from memory.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Pupy can execute Lazagne as well as Mimikatz using PowerShell.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Pysa can perform OS credential dumping using Mimikatz.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
Windows Credential Editor can dump credentials.
Technique: T1003.001 OS Credential Dumping: LSASS Memory, Tactic: TA0006 Credential Access
During C0017, APT41 copied the `SAM` and `SYSTEM` Registry hives for credential harvesting.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
During Night Dragon, threat actors dumped account hashes using gsecdump.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
APT29 has used the `reg save` command to save registry hives.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
APT41 extracted user account data from the Security Account Managerr (SAM), making a copy of this database from the registry using the `reg save` command or by exploiting volume shadow copies.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
APT5 has copied and exfiltrated the SAM Registry hive from targeted systems.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Dragonfly has dropped and executed SecretsDump to dump password hashes.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
FIN13 has extracted the SAM and SYSTEM registry hives using the `reg.exe` binary for obtaining password hashes from a compromised machine.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
GALLIUM used `reg` commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Ke3chang has dumped credentials, including by using gsecdump.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Cobalt Strike can recover hashed passwords.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
CosmicDuke collects Windows account hashes.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
CrackMapExec can dump usernames and hashed passwords from the SAM.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Fgdump can dump Windows password hashes.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
IceApple's Credential Dumper module can dump encrypted password hashes from SAM registry keys, including `HKLM\SAM\SAM\Domains\Account\F` and `HKLM\SAM\SAM\Domains\Account\Users\*\V`.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Koadic can gather hashed passwords by dumping SAM/SECURITY hive.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Mivast has the capability to gather NTLM password information.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
POWERTON has the ability to dump password hashes.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
Remsec can dump the SAM database.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
gsecdump can dump Windows password hashes from the SAM.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
pwdump can be used to dump credentials from the SAM.
Technique: T1003.002 OS Credential Dumping: Security Account Manager, Tactic: TA0006 Credential Access
During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract 
ntds.dit.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
APT41 used ntdsutil to obtain a copy of the victim environment `ntds.dit` file.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via `msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv` and used ntdsutil to copy the Active Directory database.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
FIN13 has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Ke3chang has used NTDSDump and other password dumping tools to gather credentials.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
LAPSUS$ has used Windows built-in tool `ntdsutil` to extract the Active Directory (AD) database.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used `reg save` on the SYSTEM file Registry location to help extract the NTDS.dit file.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Sandworm Team has used `ntdsutil.exe` to back up the Active Directory database, likely for credential access.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Scattered Spider has extracted the `NTDS.dit` file by creating volume shadow copies of virtual domain controller disks.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database. Wizard Spider has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
menuPass has used Ntdsutil to dump credentials.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
esentutl can copy `ntds.dit` using the Volume Shadow Copy service.
Technique: T1003.003 OS Credential Dumping: NTDS, Tactic: TA0006 Credential Access
APT29 has used the `reg save` command to extract LSA secrets offline.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
Dragonfly has dropped and executed SecretsDump to dump password hashes.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
Ke3chang has dumped credentials, including by using gsecdump.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
Leafminer used several tools for retrieving login and password information, including LaZagne.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
MuddyWater has performed credential dumping with LaZagne.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
AADInternals can dump secrets from the Local Security Authority.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
CosmicDuke collects LSA secrets.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\*\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\*\OldVal`.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
LaZagne can perform credential dumping from LSA secrets to obtain account and password information.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
Pupy can use Lazagne for harvesting credentials.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
gsecdump can dump LSA secrets.
Technique: T1003.004 OS Credential Dumping: LSA Secrets, Tactic: TA0006 Credential Access
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
Technique: T1003.005 OS Credential Dumping: Cached Domain Credentials, Tactic: TA0006 Credential Access
Leafminer used several tools for retrieving login and password information, including LaZagne.
Technique: T1003.005 OS Credential Dumping: Cached Domain Credentials, Tactic: TA0006 Credential Access
MuddyWater has performed credential dumping with LaZagne.
Technique: T1003.005 OS Credential Dumping: Cached Domain Credentials, Tactic: TA0006 Credential Access
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.
Technique: T1003.005 OS Credential Dumping: Cached Domain Credentials, Tactic: TA0006 Credential Access
Cachedump can extract cached password hashes from cache entry information.
Technique: T1003.005 OS Credential Dumping: Cached Domain Credentials, Tactic: TA0006 Credential Access
LaZagne can perform credential dumping from MSCache to obtain account and password information.
Technique: T1003.005 OS Credential Dumping: Cached Domain Credentials, Tactic: TA0006 Credential Access
Okrum was seen using modified Quarks PwDump to perform credential dumping.
Technique: T1003.005 OS Credential Dumping: Cached Domain Credentials, Tactic: TA0006 Credential Access
Pupy can use Lazagne for harvesting credentials.
Technique: T1003.005 OS Credential Dumping: Cached Domain Credentials, Tactic: TA0006 Credential Access
During C0027, Scattered Spider performed domain replication.
Technique: T1003.006 OS Credential Dumping: DCSync, Tactic: TA0006 Credential Access
During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.
Technique: T1003.006 OS Credential Dumping: DCSync, Tactic: TA0006 Credential Access
During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.
Technique: T1003.006 OS Credential Dumping: DCSync, Tactic: TA0006 Credential Access
Earth Lusca has used a `DCSync` command with Mimikatz to retrieve credentials from an exploited controller.
Technique: T1003.006 OS Credential Dumping: DCSync, Tactic: TA0006 Credential Access
LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.
Technique: T1003.006 OS Credential Dumping: DCSync, Tactic: TA0006 Credential Access
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.
Technique: T1003.006 OS Credential Dumping: DCSync, Tactic: TA0006 Credential Access
LaZagne can use the `<PID>/maps` and `<PID>/mem` files to identify regex patterns to dump cleartext passwords from the browser's process memory.
Technique: T1003.007 OS Credential Dumping: Proc Filesystem, Tactic: TA0006 Credential Access
MimiPenguin can use the `<PID>/maps` and `<PID>/mem` file to search for regex patterns and dump the process memory.
Technique: T1003.007 OS Credential Dumping: Proc Filesystem, Tactic: TA0006 Credential Access
PACEMAKER has the ability to extract credentials from OS memory.
Technique: T1003.007 OS Credential Dumping: Proc Filesystem, Tactic: TA0006 Credential Access
LaZagne can obtain credential information from /etc/shadow using the shadow.py module.
Technique: T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow, Tactic: TA0006 Credential Access
During C0015, the threat actors obtained files and data from the compromised network.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During C0017, APT41 collected information related to compromised machines as well as Personal Identifiable Information (PII) from victim networks.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During C0026, the threat actors collected documents from compromised hosts.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During CostaRicto, the threat actors collected data and files from compromised networks.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During Frankenstein, the threat actors used Empire to gather various local system information.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During Night Dragon, the threat actors collected files and other data from compromised systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During Operation Honeybee, the threat actors collected data from compromised hosts.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
During the SolarWinds Compromise, APT29 extracted files from compromised networks.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
APT1 has collected files from a local victim.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
APT29 has stolen data from compromised hosts.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
APT3 will identify Microsoft Office documents on the victim's computer.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
APT37 has collected data from victims' local systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
APT38 has collected data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
APT39 has used various tools to steal files from the compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
APT41 has uploaded files and data from a compromised host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Andariel has collected large numbers of files from compromised network systems for later extraction.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Axiom has collected data from a compromised network.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
BRONZE BUTLER has exfiltrated files stolen from local systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
CURIUM has exfiltrated data from a compromised machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Dragonfly has collected data from local victim systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
FIN13 has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
FIN6 has collected and exfiltrated payment card data from compromised systems.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
FIN7 has collected files and other sensitive information from a compromised network.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Fox Kitten has searched local system resources to access sensitive documents.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
HAFNIUM has collected data and files from a compromised machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Ke3chang gathered information and files from local directories for exfiltration.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Kimsuky has collected Office, PDF, and HWP documents from its victims.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Lazarus Group has collected data and files from compromised networks.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
LuminousMoth has collected files and data from compromised machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Patchwork collected and exfiltrated files from the infected system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Stealth Falcon malware gathers data from the local victim system.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
ToddyCat has run scripts to collect documents from targeted hosts.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Turla RPC backdoors can upload files from victim machines.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection
Volt Typhoon has stolen the Active Directory database from targeted environments and used Wevtutil to extract event log information.
Technique: T1005 Data from Local System, Tactic: TA0009 Collection