T1003 OS Credential Dumping

Technique: T1003
Tactics: Credential Access
Research, 90 days: 0
KEV CVEs mapped: 18
SigmaHQ rules: 36
Elastic, Splunk: 78
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1003

MITRE description

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Detection coverage

SigmaHQ community rules

Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 (emerging-threats)
Access To Chromium Browsers Sensitive Files By Uncommon Applications (threat-hunting)
Access To Browser Credential Files By Uncommon Applications (threat-hunting)
OpenCanary - MSSQL Login Attempt Via SQLAuth (core)
OpenCanary - MSSQL Login Attempt Via Windows Authentication (core)
OpenCanary - MySQL Login Attempt (core)
OpenCanary - REDIS Action Command Attempt (core)
Antivirus - Password Dumper Signature (core)
PUA - AWS TruffleHog Execution (core)
Rare Subscription-level Operations In Azure (core)
Linux Keylogging with Pam.d (core)
WCE wceaux.dll Access (core)
File Access Of Signal Desktop Sensitive Data (core)
Credential Manager Access By Uncommon Applications (core)
Access To Crypto Currency Wallets By Uncommon Applications (core)
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump (core)
Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location (core)
HackTool - Rubeus Execution - ScriptBlock (core)
Live Memory Dump Using Powershell (core)
Potential Invoke-Mimikatz PowerShell Script (core)
Esentutl Gather Credentials (core)
Hacktool Execution - Imphash (core)
Hacktool Execution - PE Metadata (core)
HackTool - Rubeus Execution (core)
Microsoft IIS Service Account Password Dumped (core)

Showing 25 of 36 community rules. the full set is tagged attack.t1003 in SigmaHQ.

Elastic and Splunk rules

Potential Secret Scanning via Gitleaks (elastic)
Credential Access via TruffleHog Execution (elastic)
Web Server Potential Command Injection Request (elastic)
Potential Linux Credential Dumping via Unshadow (elastic)
Linux init (PID 1) Secret Dump via GDB (elastic)
Linux Process Hooking via GDB (elastic)
Manual Memory Dumping via Proc Filesystem (elastic)
Potential Linux Credential Dumping via Proc Filesystem (elastic)
Segfault from Sensitive Process Detected (elastic)
Suspicious /proc/maps Discovery (elastic)
Suspicious Execution from Foomatic-rip or Cupsd Parent (elastic)
Potential Suspicious File Edit (elastic)
Potential Unauthorized Access via Wildcard Injection Detected (elastic)
Potential Privilege Escalation via Linux DAC permissions (elastic)
Suspicious Symbolic Link Created (elastic)
Potential Shadow File Read via Command Line Utilities (elastic)
Dumping Account Hashes via Built-In Commands (elastic)
Kerberos Cached Credentials Dumping (elastic)
Credential Dumping - Detected - Elastic Endgame (elastic)
Credential Dumping - Prevented - Elastic Endgame (elastic)
Potential Credential Access via Windows Utilities (elastic)
NTDS or SAM Database File Copied (elastic)
Potential Credential Access via Trusted Developer Utility (elastic)
First Time Seen Account Performing DCSync (elastic)
Potential Credential Access via DCSync (elastic)

Showing 25 of 78.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.