Credential-Dumping

Attackers utilize the legitimate Windows utility esentutl.exe to perform unauthorized copies of the SAM and ntds.dit files for offline credential extraction, facilitating privilege escalation and lateral movement.

Detection of the UseLogonCredential registry modification used to enable plaintext credential storage in Windows memory for post-exploitation credential dumping.

Adversaries utilize the legitimate Sysinternals utility procdump.exe to extract sensitive credentials from the LSASS process memory to facilitate lateral movement and privilege escalation.

Detection of attackers creating symbolic links to Volume Shadow Copies to bypass file system locks and access sensitive system files for credential theft.

Adversaries may use the legitimate Windows Task Manager utility to create a memory dump of the Local Security Authority Subsystem Service (LSASS) process to harvest sensitive credentials.

This brief details the detection of Procdump, a legitimate Sysinternals utility, which is frequently abused by attackers for credential dumping from sensitive processes like LSASS, enabling privilege escalation and lateral movement on Windows systems.

This brief focuses on the detection of renamed Sysinternals ProcDump executables, a technique often employed by threat actors to evade security controls and perform credential dumping from LSASS memory on Windows systems, leading to potential lateral movement and privilege escalation.

This brief details a detection for potentially suspicious `GrantedAccess` flags when a process attempts to access `LSASS.exe`, indicating possible credential dumping attempts by adversaries, which can lead to lateral movement and privilege escalation on Windows systems.

This brief describes the detection of suspicious access mask requests to the Local Security Authority Subsystem Service (LSASS) process, a common post-exploitation technique used by threat actors for credential dumping on Windows systems.

Attackers are abusing the legitimate Windows Print.exe utility to copy sensitive files like NTDS.DIT and SAM in order to extract credentials, enabling local or remote credential access.