A small set of publicly available tools does most of the credential theft in real intrusions, and MITRE ATT&CK links Mimikatz alone to 51 threat groups. This hub catalogues the 17 credential and Active Directory attack tools in ATT&CK Enterprise v20, from Mimikatz, Impacket and Rubeus to Responder, evilginx2 and TruffleHog. It computes which credential techniques they share from ATT&CK's mappings and turns them into detection, hardening and measurement guidance for Windows, Active Directory, SaaS and code repositories. It is written for SOC analysts, detection engineers and identity administrators. Several of these tools are also used legitimately in authorised testing and secret scanning, so the guidance focuses on behaviour, not on the binary name.
Key takeaways
- Credential dumping dominates: nine of the 17 tools map to T1003 OS Credential Dumping, most often T1003.002 Security Account Manager (five) and T1003.001 LSASS Memory (four), so protecting LSASS and the SAM covers more than half the catalogue.
- Two tools carry most real use: ATT&CK links Mimikatz to 51 groups and Impacket to 18, including APT29, Sandworm Team, Scattered Spider and Volt Typhoon, so detections for their behaviours pay back fastest.
- Kerberos abuse is concentrated: Mimikatz, Impacket and Rubeus map to T1558 Steal or Forge Kerberos Tickets, covering Golden Ticket, Silver Ticket, Kerberoasting and AS-REP Roasting, all visible in domain controller events 4768 and 4769.
- Identity attacks moved beyond Windows: evilginx2 maps to T1557 Adversary-in-the-Middle, T1539 Steal Web Session Cookie and T1111 Multi-Factor Authentication Interception against identity providers and SaaS, and TruffleHog maps to T1552.001 Credentials In Files and T1528 Steal Application Access Token.
- Built-in Windows protections close the cheapest paths: LSA protection blocks untrusted reads of LSASS memory and Credential Guard isolates NTLM hashes and Kerberos TGTs, but neither protects the SAM or the Active Directory database, so DCSync and NTDS theft need their own controls.
What this category covers and why it matters
The category holds 17 ATT&CK v20 entries, all typed as tools rather than malware: software that is publicly available and used by defenders and testers as well as attackers. They fall into five groups:
- Windows credential dumpers: Mimikatz, Windows Credential Editor, pwdump, gsecdump, Fgdump, Cachedump and Lslsass, which read LSASS memory, the SAM, LSA secrets or cached domain credentials.
- Kerberos and Active Directory toolkits: Mimikatz (DCSync, Golden and Silver Tickets, SID-History injection, rogue domain controller), Impacket (NTDS extraction, Kerberoasting, ccache files, remote service execution) and Rubeus (Kerberoasting, AS-REP Roasting, ticket forging, domain trust discovery).
- Network credential capture and relay: Responder (T1557.001 Name Resolution Poisoning and SMB Relay, T1040 Network Sniffing), Pass-The-Hash Toolkit (T1550.002) and NPPSPY, which ATT&CK maps to capturing logon credentials through a network provider.
- Cloud and SaaS credential theft: evilginx2, an adversary-in-the-middle phishing framework mapped to identity provider, office suite, SaaS and IaaS platforms, and TruffleHog, a secret scanner mapped to collecting credentials from files, code repositories and cloud storage.
- Other: MimiPenguin (Linux credentials from the proc filesystem, linked to TeamTNT), spwebmember (SharePoint data, linked to Ke3chang) and Invoke-PSImage (hiding PowerShell in images, linked to Sandworm Team).
These tools sit at the point where an intrusion becomes a domain or tenant compromise. Most ransomware and espionage chains in ATT&CK pass through one of them, which is why the Credential Dumping Guide and the T1003 OS Credential Dumping page cover the technique in depth; this hub is the tool view.
Common behaviours across the catalogue
Counts are tools mapped to each parent technique in ATT&CK v20 (a tool counts once), computed from the software-to-technique relationships.
| Technique | Tools (of 17) | Sub-techniques seen | Primary telemetry |
|---|---|---|---|
| T1003 OS Credential Dumping | 9 | T1003.002 SAM (5); T1003.001 LSASS Memory (4); T1003.004 LSA Secrets (3); T1003.003 NTDS, T1003.005 Cached Domain Credentials, T1003.006 DCSync, T1003.007 Proc Filesystem (1 each) | Process access to lsass.exe; registry hive saves; event 4662 replication rights on domain controllers |
| T1557 Adversary-in-the-Middle | 4 | T1557.001 Name Resolution Poisoning and SMB Relay (2) | LLMNR and NBT-NS responses from non-DNS hosts; identity provider sign-ins from proxy infrastructure |
| T1558 Steal or Forge Kerberos Tickets | 3 | T1558.001 Golden Ticket and T1558.002 Silver Ticket (2 each); T1558.003 Kerberoasting (2); T1558.004 AS-REP Roasting; T1558.005 Ccache Files | Events 4768 and 4769 with RC4 (0x17) encryption; ticket anomalies |
| T1552 Unsecured Credentials | 3 | T1552.001 Credentials In Files; T1552.004 Private Keys | Bulk reads of repositories and file shares; certificate private key export |
| T1550 Use Alternate Authentication Material | 2 | T1550.002 Pass the Hash; T1550.003 Pass the Ticket | NTLM logons (4624 logon type 3) from unusual sources; ticket reuse across hosts |
| T1555 Credentials from Password Stores | 2 | T1555.003 Web Browsers; T1555.004 Windows Credential Manager; T1555.006 Cloud Secrets Management Stores | Access to browser and vault files; bulk secret reads in cloud audit logs |
| T1040 Network Sniffing | 2 | Parent technique | Promiscuous mode and packet capture on servers |
| T1213 Data from Information Repositories | 2 | T1213.002 Sharepoint (2); T1213.003 Code Repositories | Bulk SharePoint and repository access by one identity |
Catalogue: every credential and Active Directory attack tool in ATT&CK v20
All 17 entries, alphabetical. Platforms and groups come from ATT&CK v20; where a tool is linked to many groups, the count is given with a few examples. "Key techniques" shows up to four mappings that show what is distinctive about each tool.
| ID | Name | Type | Platforms | Groups linked in ATT&CK | Key techniques |
|---|---|---|---|---|---|
| S0119 | Cachedump | Tool | Windows | APT1 | T1003.005 Cached Domain Credentials |
| S9003 | evilginx2 | Tool | IaaS, Identity Provider, Office Suite, SaaS | None linked in ATT&CK | T1557 Adversary-in-the-Middle; T1539 Steal Web Session Cookie; T1111 Multi-Factor Authentication Interception; T1001 Data Obfuscation |
| S0120 | Fgdump | Tool | Windows | None linked in ATT&CK | T1003.002 Security Account Manager |
| S0008 | gsecdump | Tool | Windows | 5 groups, including APT1, PittyTiger, Threat Group-3390, BRONZE BUTLER, Tonto Team | T1003.002 Security Account Manager; T1003.004 LSA Secrets |
| S0357 | Impacket | Tool | Linux, macOS, Windows | 18 groups, including APT29, Cinnamon Tempest, Sandworm Team, Velvet Ant, Volt Typhoon | T1558.003 Kerberoasting; T1003.001 LSASS Memory; T1003.002 Security Account Manager; T1003.003 NTDS |
| S0231 | Invoke-PSImage | Tool | Not specified in ATT&CK | Sandworm Team | T1027.003 Steganography; T1027.009 Embedded Payloads |
| S0121 | Lslsass | Tool | Windows | APT1 | T1003.001 LSASS Memory |
| S0002 | Mimikatz | Tool | Windows | 51 groups, including APT28, APT29, Sandworm Team, Scattered Spider, Volt Typhoon | T1003.006 DCSync; T1558.001 Golden Ticket; T1003.001 LSASS Memory; T1003.002 Security Account Manager |
| S0179 | MimiPenguin | Tool | Linux | TeamTNT | T1003.007 Proc Filesystem |
| S1131 | NPPSPY | Tool | Windows | None linked in ATT&CK | T1557 Adversary-in-the-Middle; T1684.001 Impersonation; T1005 Data from Local System; T1056 Input Capture |
| S0122 | Pass-The-Hash Toolkit | Tool | Not specified in ATT&CK | APT1 | T1550.002 Pass the Hash |
| S0006 | pwdump | Tool | Windows | 6 groups, including APT1, Threat Group-3390, menuPass, FIN5, APT39 | T1003.002 Security Account Manager |
| S0174 | Responder | Tool | Not specified in ATT&CK | APT28, Lazarus Group, Ember Bear | T1557.001 Name Resolution Poisoning and SMB Relay; T1040 Network Sniffing |
| S1071 | Rubeus | Tool | Windows | Wizard Spider | T1558.001 Golden Ticket; T1558.003 Kerberoasting; T1558.004 AS-REP Roasting; T1482 Domain Trust Discovery |
| S0227 | spwebmember | Tool | Windows | Ke3chang | T1213.002 Sharepoint |
| S9009 | TruffleHog | Tool | IaaS, Linux, SaaS, Windows | None linked in ATT&CK | T1552.001 Credentials In Files; T1528 Steal Application Access Token; T1213.002 Sharepoint; T1005 Data from Local System |
| S0005 | Windows Credential Editor | Tool | Windows | 7 groups, including Threat Group-3390, FIN6, FIN5, BRONZE BUTLER, Leviathan | T1003.001 LSASS Memory |
See the Scattered Spider Threat Actor Profile, the Volt Typhoon Threat Actor Profile, the APT29 (Midnight Blizzard) Threat Actor Profile and the Sandworm Threat Actor Profile for how named groups combine these tools.
Detection themes
| Behaviour | Tools | Signal | Where |
|---|---|---|---|
| LSASS memory access | Mimikatz, Windows Credential Editor, Lslsass, Impacket | Handle opened to lsass.exe with memory read rights by a non-security process (Sysmon event 10); dump files written to disk | Endpoints, servers |
| SAM and LSA secrets theft | pwdump, gsecdump, Fgdump, Mimikatz, Impacket | Saving the SAM, SYSTEM or SECURITY registry hives; remote registry access to member servers | Endpoints, servers |
| DCSync | Mimikatz | Event 4662 showing directory replication rights used by an account that is not a domain controller | Domain controllers |
| Kerberoasting and AS-REP Roasting | Impacket, Rubeus | Event 4769 requests with ticket encryption type 0x17 (RC4) for many service accounts from one source; event 4768 for accounts without pre-authentication | Domain controllers |
| Forged tickets | Mimikatz, Rubeus | Service ticket use with no matching TGT request, tickets with unusual lifetimes, RC4 tickets in an AES only domain | Domain controllers, EDR |
| Name resolution poisoning and relay | Responder, Impacket | LLMNR and NBT-NS answers from workstations; NTLM authentication to unexpected hosts | Network, endpoints |
| Network provider capture | NPPSPY | New network provider DLL registrations in the registry | Endpoints |
| AiTM session theft | evilginx2 | Sign-in followed by session use from a different IP or ASN; sign-ins from newly registered look-alike domains | Identity provider logs |
| Bulk secret discovery | TruffleHog | Secret scanner execution on hosts or runners that do not run it by design; bulk repository clones | EDR, Git platform audit logs |
Microsoft documents event 4769 as logged only on domain controllers under the Audit Kerberos Service Ticket Operations subcategory, and recommends alerting on any ticket encryption type other than 0x11 or 0x12 (AES) on modern domains. The Active Directory Security Monitoring and Event IDs Guide covers audit policy, and the Kerberoasting and AS-REP Roasting Defence Guide covers tuning.
Hardening that breaks the common chains
- Turn on LSA protection: set RunAsPPL under HKLM\SYSTEM\CurrentControlSet\Control\Lsa (1 with UEFI lock, 2 without). Microsoft documents an audit mode first (AuditLevel 8 under the LSASS.exe Image File Execution Options key) that logs CodeIntegrity events 3065 and 3066 for plug-ins that would fail; confirm with WinInit event 12. Rolling back a UEFI locked setting needs Microsoft's opt-out tool, so pilot with value 2.
- Deploy Credential Guard: it isolates NTLM hashes, Kerberos TGTs and stored domain credentials in LSAIso.exe and is on by default on eligible domain joined Windows 11 22H2 and later devices. Test applications that need NTLMv1, Kerberos DES or unconstrained delegation first. See Credential Guard and VBS.
- Remove the RC4 and NTLM paths: give service accounts long random passwords or move them to managed service accounts, require AES, and plan NTLM removal. See Kerberos RC4 Deprecation and the NTLM Relay Guide.
- Disable LLMNR and NBT-NS and require SMB signing: this removes Responder's poisoning and relay path. See LLMNR and NBT-NS Poisoning.
- Restrict replication rights and tier admin accounts: only domain controllers should hold directory replication rights; keep domain admin credentials off workstations. Plan a double krbtgt reset after any suspected Golden Ticket. See the krbtgt account guide.
- Use phishing-resistant MFA: FIDO2 and passkeys bind authentication to the real origin, which defeats evilginx2 style proxies. See the Phishing-Resistant MFA Guide and the AiTM Phishing Guide.
Roll each change out in rings (pilot, IT, general, servers, domain controllers last), watch the audit events for one to two weeks per ring, and keep the previous group policy object ready to relink.
Where identity fits
Every tool in this hub turns stolen authentication material into access, and much of that material belongs to non-human identities: service accounts with SPNs that Kerberoasting targets, LSA secrets holding service account passwords, the krbtgt account, and API keys and tokens that TruffleHog finds in code. TruffleHog is a legitimate secret scanner, which is why the Shai-Hulud worm could run it on infected developer machines to find keys; see the Shai-Hulud npm Worm, First Wave (September 2025). Run secret scanning yourself first and rotate what it finds. See the Git Secret Scanning Guide and How to build a service account inventory from Active Directory.
Measuring coverage
- LSASS protection: percentage of Windows endpoints and servers with LSA protection enforced (WinInit event 12 seen).
- Credential Guard coverage: percentage of eligible devices with Credential Guard running.
- RC4 ticket volume: daily count of 4769 events with encryption type 0x17, trending to zero.
- Roastable accounts: number of user accounts with SPNs or without Kerberos pre-authentication.
- Phishing-resistant MFA: share of privileged and workforce sign-ins using FIDO2 or passkeys.
- Detection tests: share of the nine detection themes validated in an authorised test in the last quarter.
Common failure patterns
- Detecting tool names instead of behaviour: renamed or recompiled builds of Mimikatz and Impacket evade hash and name rules; LSASS access and 4662 replication events do not change.
- Relying on Credential Guard for domain controllers: Microsoft does not recommend it on domain controllers and it does not protect the SAM or the Active Directory database, so DCSync and NTDS theft still need monitoring.
- Service accounts with old, guessable passwords: they make Kerberoasting offline cracking succeed.
- Leaving LLMNR and NBT-NS on: Responder needs no exploit when name resolution falls back to broadcast.
- Treating push or SMS MFA as phishing proof: AiTM proxies capture the session cookie after MFA completes.
- Resetting krbtgt once: a single reset leaves forged tickets valid against the previous key.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 Authenticator Management; AC-6 Least Privilege; SI-4 System Monitoring; IA-2 Identification and Authentication | Service account passwords and rotation, admin tiering, domain controller monitoring, phishing-resistant MFA |
| NIST CSF 2.0 | PR.AA-05; DE.CM-09 | Least privilege for replication rights and admin accounts; endpoint and identity monitoring |
| CIS Controls v8.1 | Control 5 Account Management; Control 6 Access Control Management; Control 8 Audit Log Management | Service accounts, MFA, Kerberos and LSASS audit coverage |
| ISO/IEC 27001:2022 Annex A | A.5.17 Authentication information; A.8.2 Privileged access rights; A.8.5 Secure authentication | Credential protection and admin tiering |
Practitioner checklist
- Alert on non-security processes opening lsass.exe for memory reads.
- Enforce LSA protection after an audit mode pilot.
- Confirm Credential Guard is running on eligible endpoints.
- Alert on 4662 replication rights used by non-domain controller accounts.
- Alert on RC4 service tickets and remove RC4 from service accounts.
- Remove "Do not require Kerberos preauthentication" from every account.
- Disable LLMNR and NBT-NS and require SMB signing.
- Require phishing-resistant MFA for administrators and high risk users.
- Run secret scanning on your own repositories and rotate what it finds.
- Rehearse a double krbtgt reset in the domain compromise playbook.
Standards and references
- MITRE ATT&CK: S0002 Mimikatz
- MITRE ATT&CK: S0357 Impacket
- MITRE ATT&CK: T1003 OS Credential Dumping
- MITRE ATT&CK: T1558 Steal or Forge Kerberos Tickets
- Microsoft: Configure added LSA protection
- Microsoft: Credential Guard overview
- Microsoft: 4769(S, F) A Kerberos service ticket was requested
- ASD ACSC and CISA: Detecting and Mitigating Active Directory Compromises
Related NHI Mgmt Group resources: Credential Dumping Guide · MITRE ATT&CK T1558 Steal or Forge Kerberos Tickets Guide · Active Directory Domain Compromise Response Playbook · ATT&CK Botnets, Worms and Cryptominers Software Hub