Wiki › Techniques, Tactics & Procedures (TTPs) › Privilege Escalation › Credential Dumping for Privilege Escalation

Credential Dumping for Privilege Escalation

2 min read

Jump to:

Overview

Credential dumping for privilege escalation is a technique used by adversaries to extract account credentials from operating systems or software in order to gain higher-level access within a target environment. This technique plays a critical role in the attack lifecycle by enabling attackers to move beyond initial footholds and escalate privileges to access sensitive resources or systems.

Attack Objective

Obtain credentials to elevate privileges and gain broader access
Supports the Privilege Escalation stage and facilitates Lateral Movement
Advances the attacker’s position by enabling access to accounts with greater permissions, often leading to domain or system-wide control

How the Technique Works

Credential dumping involves extracting stored authentication data such as password hashes, plaintext passwords, Kerberos tickets, or tokens from memory, system files, or credential stores. Attackers leverage system APIs, memory analysis, or direct access to credential repositories to collect these secrets, which can then be used to impersonate users or authenticate to other systems.

Common Methods & Variations

Utilization of native operating system tools and APIs (e.g., LSASS memory access on Windows)
Extraction from local endpoints, domain controllers, or cloud identity stores
Use of living-off-the-land binaries and scripts versus custom or third-party credential dumping tools

Indicators of Compromise (IOCs)

Unusual access to credential storage locations or memory processes
Execution of known credential dumping utilities or suspicious command-line activity
Authentication anomalies such as unusual account usage or ticket requests
Endpoint logs showing access to LSASS or other credential caches

Detection Strategies

Monitoring process creation and memory access events on endpoints
Behavioral detection focusing on anomalous credential access patterns
Correlation of authentication logs with suspicious process activity

Mitigation & Prevention

Implement least privilege and restrict administrative rights
Enable credential guard and secure credential storage mechanisms
Use multi-factor authentication to reduce reliance on stolen credentials
Regularly update and patch systems to limit exploitation of vulnerabilities

Response Considerations

Immediately isolate affected systems to prevent further credential harvesting
Conduct thorough investigation to identify scope and compromised accounts
Reset credentials and review privilege assignments post-incident
Enhance monitoring and apply security controls to prevent recurrence

Related Techniques

Pass-the-Hash and Pass-the-Ticket attacks
Account Manipulation and Credential Access
Lateral Movement through remote services

Mapping & References

MITRE ATT&CK Tactic: Privilege Escalation
MITRE ATT&CK Technique: Credential Dumping (T1003)
Public research and advisories on credential dumping methods and defenses

Tags: Attack Techniques Credential Dumping credential theft Cybersecurity endpoint security Incident Response MITRE ATT&CK privilege escalation Security Monitoring Threat Detection