T1003 OS Credential Dumping: Detection and Log Sources

OS Credential Dumping (T1003) is the step where one compromised host becomes many, because the hashes, tickets and service account secrets stored on it are reused everywhere else. ATT&CK v20 records 211 procedure examples across the technique and its eight sub-techniques, with LSASS Memory (T1003.001) alone accounting for 79. This page is the detection engineer's view of T1003: the analytic logic ATT&CK v20 attaches to each sub-technique, the exact log sources and event IDs behind it, how to tune out the noise, and where the technique reaches beyond Windows into Linux build runners, containers and the non-human identities they carry. For the hardening walkthrough (LSA protection, Credential Guard, WDigest, LAPS and the phased rollout) see the Credential Dumping Guide; this page does not repeat it.

Key takeaways

Every T1003 sub-technique needs elevated rights. SYSTEM, local admin, root or directory replication rights are the precondition, so privilege telemetry is half of the detection story.
ATT&CK v20 detects sequences, not single events. Each sub-technique's detection strategy chains an access event (handle, registry or file read) with a follow-on artefact such as a dump file or hive copy.
Domain controllers and sync servers need their own telemetry. DCSync (T1003.006) and NTDS (T1003.003) show up as event 4662 replication rights use and shadow copy creation, not as endpoint process events.
Linux memory scraping is a CI/CD problem as much as a server one. The 2025 tj-actions compromise read secrets out of a build runner's process memory, the pattern T1003.007 describes.
Most of what is dumped is non-human. Service account passwords in LSA secrets, machine account hashes, krbtgt and sync accounts outlive user password resets, so response has to rotate them.

How the attack works

ATT&CK v20 defines T1003 as dumping credentials "to obtain account login and credential material, normally in the form of a hash or a clear text password" from OS caches, memory or structures, then using them for lateral movement. The sub-techniques differ mainly in where the material lives and which telemetry the access leaves. The procedure counts below are the number of recorded "uses" relationships in the v20 enterprise dataset.

Sub-technique	Store	Precondition	v20 procedure examples	What the attacker gets
T1003.001 LSASS Memory	lsass.exe process memory	Admin or SYSTEM, debug right	79	NTLM hashes, Kerberos tickets, sometimes clear text for logged-on sessions
T1003.002 Security Account Manager	HKLM\SAM hive (with SYSTEM hive for the boot key)	SYSTEM	37	Local account hashes, including RID 500
T1003.003 NTDS	%SystemRoot%\NTDS\Ntds.dit on domain controllers, and backups	Admin on a DC or access to a backup	27	Every domain account hash, including krbtgt
T1003.004 LSA Secrets	HKLM\SECURITY\Policy\Secrets	SYSTEM	20	Service account passwords, machine account secret
T1003.005 Cached Domain Credentials	DCC2 cache on Windows; SSSD or Quest caches on Linux	SYSTEM or root	9	Hashes that must be cracked (no pass-the-hash)
T1003.006 DCSync	Active Directory via the replication API (DRSUAPI)	Replicating Directory Changes and Replicating Directory Changes All rights	11	Current and historical hashes for any account, including krbtgt
T1003.007 Proc Filesystem	/proc/<PID>/maps and /proc/<PID>/mem on Linux	Root (or same-user access to own processes)	5	Secrets held in process memory: tokens, passwords, keys
T1003.008 /etc/passwd and /etc/shadow	/etc/shadow	Root	3	Password hashes for offline cracking

Stolen hashes and tickets feed straight into T1550 Use Alternate Authentication Material (for example T1550.002 Pass the Hash), and a krbtgt hash from NTDS or DCSync enables T1558.001 Golden Ticket. See the Golden Ticket, Silver Ticket and DCSync Guide for that follow-on stage.

Where it shows up

Ransomware and hybrid cloud intrusions: after initial access, operators dump credentials until they reach Domain Admin, then hunt for servers that bridge to the cloud. In the Storm-0501 hybrid cloud attacks, Microsoft reported Impacket SecretsDump use on the way to Domain Admin, followed by plain text credential theft from Entra Connect Sync servers.
Service account harvesting on member servers: any server that runs a Windows service under a domain account holds that password as an LSA secret. Backup, monitoring and database servers are the usual targets.
Linux build runners and containers: CI jobs decrypt secrets into the memory of the runner process. A job that can read another process's memory (root in the runner, or a shared user) can collect them, which is why the tj-actions/changed-files compromise in March 2025 printed secrets from the Runner.Worker process into build logs.
Directory backups and virtualised DCs: T1003.003 explicitly includes backups. A copy of Ntds.dit in a backup share, or a domain controller VM disk readable from the hypervisor, gives the same result as a live dump with none of the DC telemetry.
Linux hosts joined to AD: SSSD caches (/var/lib/sss/db/cache.[domain].ldb) hold domain credential hashes. See the SSSD and Linux Active Directory Integration Guide.

Impact

The impact of a dump scales with the store, not the host. An LSASS dump exposes the identities that were logged on to that host; a SAM dump exposes local accounts, which matters most where the local administrator password is shared (the reason for Windows LAPS); an LSA secrets dump exposes service accounts that may have rights across hundreds of servers; and NTDS or DCSync exposes the entire domain, including krbtgt, which means forged tickets that survive user password resets. Scope response by the store you have evidence for, then assume the wider set until the timeline rules it out.

Detection

ATT&CK v20 attaches one detection strategy to T1003 and one to each sub-technique. The common thread is correlation: an access event on a credential store, by an unusual process or account, followed within a short window by an artefact (a dump file, a saved hive, a shadow copy or a replication request). The table translates those strategies into log sources and the logic to build.

Sub-technique	Log sources named in ATT&CK v20	Analytic logic	Main tuning concern
T1003.001 LSASS Memory	Sysmon 10 (ProcessAccess), Sysmon 1, Sysmon 11, Sysmon 13/14, Security 4673	Process other than a known security or system binary opens lsass.exe with broad access rights (ATT&CK cites 0x1F0FFF), then a .dmp or unusual file is written	EDR, antivirus and backup agents open LSASS legitimately; allowlist by signed image path, not name
T1003.002 SAM	Security 4688, Sysmon 13/14 (registry), Sysmon 11 (file create), Sysmon 2	Process creation that saves HKLM\SAM and HKLM\SYSTEM, or creates .save/.hiv/.dmp files, in sequence	Rare in normal operations; few exclusions needed
T1003.003 NTDS	Security 4688, Sysmon 11, Sysmon 2, VSS shadow copy creation events	Shadow copy creation or ntdsutil use on a DC, followed by access to or a copy of ntds.dit outside its normal path	Scheduled system state backups; match against the backup service account and schedule
T1003.004 LSA Secrets	Registry and memory access telemetry on HKLM\SECURITY\Policy\Secrets	Non-system process reads or exports the SECURITY hive	Low volume; treat as high fidelity
T1003.005 Cached credentials	Registry access on Windows; file access to SSSD or Quest caches on Linux	Read of the cache by anything other than the authentication service	SSSD itself and package updates
T1003.006 DCSync	Security 4662, Security 4929, network monitoring of RPC DRSUAPI	4662 with the replication rights GUIDs where the requesting account is not a DC computer account or the documented sync account, or DRSUAPI traffic from a non-DC address	Entra Connect and some identity tools replicate by design; list them explicitly
T1003.007 Proc Filesystem	auditd syscall records on /proc//mem and /proc//maps; process execution	Process reads another process's memory mapping or memory file, especially a runner, agent or database process	Debuggers and profilers on developer hosts; scope to servers and runners
T1003.008 /etc/shadow	auditd SYSCALL open/read, auditd execve	Read of /etc/shadow by a process other than the authentication stack, or a copy of the file	Configuration management tools that manage local users

Making the high-value analytics work

LSASS access: collect Sysmon event 10 with a ProcessAccess include rule for TargetImage ending in lsass.exe, which Microsoft's Sysmon page gives as its example filter. Alert on access masks that include memory read, from images outside a short allowlist of signed security and system binaries, then raise severity when a file is created by the same process within minutes.
DCSync: event 4662 records use of the extended rights Replicating Directory Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) and Replicating Directory Changes All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) only when directory service access auditing is on and a SACL covers the domain naming context. Build the alert as "replication right used by an account that is not a domain controller computer account and not on the named exception list".
Protection state as telemetry: record whether LSA protection is actually running, using the WinInit event 12 in the System log ("LSASS.exe was started as a protected process with level: 4"). A host that loses that event after a reboot has had protection removed, which is itself a strong signal.
Linux memory reads: add auditd rules on /proc/*/mem access and on ptrace use for runner, agent and database hosts, and forward them centrally. See the Linux Logging and auditd for Defenders Guide.
Honey credentials: plant a decoy account whose hash exists only in a credential store and alert on any authentication by it. See the Honeytokens and Canary Credentials Guide.

Measuring detection coverage

LSASS access telemetry coverage: percentage of Windows hosts sending Sysmon 10 (or EDR equivalent) for lsass.exe. Target all tier 0 and tier 1 servers first.
LSA protection verified: percentage of hosts reporting WinInit event 12 after their last reboot.
Replication rights holders: count of non-DC principals holding the two replication rights, reviewed quarterly, with a named owner for each.
Atomic test pass rate: percentage of the eight sub-techniques for which an authorised emulation in a test environment produced an alert in the last quarter.
Time to rotate: median hours from a confirmed dump to rotation of every exposed service account (our recommended target: under 24 hours for tier 0).

Prevention and hardening

ATT&CK v20 maps nine mitigations to T1003. The table shows which sub-techniques each covers and the concrete control that implements it. Settings and rollout detail are in the Credential Dumping Guide and the Credential Guard and VBS guide.

ATT&CK mitigation	Sub-techniques (v20)	Concrete control
M1043 Credential Access Protection	.001	Credential Guard on supported Windows editions
M1025 Privileged Process Integrity	.001	LSA protection: RunAsPPL = 1 (with UEFI lock) or 2 (without), per Microsoft Learn
M1040 Behavior Prevention on Endpoint	.001	Defender ASR rule "Block credential stealing from the Windows local security authority subsystem" (9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2), which Microsoft describes as an alternative where LSA protection and Credential Guard cannot be enabled
M1028 Operating System Configuration	.001, .002, .005	Limit cached logons, remove debug rights from admins who do not need them
M1015 Active Directory Configuration	.005, .006	Restrict replication rights to DCs and the documented sync account
M1041 Encrypt Sensitive Information	.003	Encrypt and access-control directory backups
M1026 Privileged Account Management	All	Tiered administration, no domain admin logons to lower tiers, root access only through brokered elevation
M1027 Password Policies	All	Unique local admin passwords (LAPS), long service account passwords or gMSA
M1017 User Training	.001 to .005	Admins trained not to log on interactively to untrusted hosts

Non-human identity and cloud angle

Stop storing service passwords on hosts: move Windows services to Group Managed Service Accounts, which removes a static, human-set password from LSA secrets.
Treat sync and identity bridge servers as tier 0: Entra Connect and similar servers hold credentials that reach the cloud tenant, as Storm-0501 showed.
Use short-lived federated credentials in CI: a runner that holds an OIDC-issued token for minutes exposes far less than one holding a long-lived cloud key. See the GitHub Actions OIDC Federation Hardening Guide.
Isolate runners: use ephemeral, single-job runners, avoid running jobs as root, and set kernel.yama.ptrace_scope to restrict cross-process memory access on persistent runners.

Lessons from incidents

Storm-0501 (2024): credential dumping led to Domain Admin, and the operators then targeted the Entra Connect Sync servers specifically. The customer-side lesson is that any server holding a cloud sync or bridge credential belongs in tier 0, with the same dumping protections and replication monitoring as a DC. Read the Storm-0501 analysis.
tj-actions/changed-files (2025): malicious code in a widely used GitHub Action read secret values from runner process memory and wrote them to build logs, exposing CI/CD secrets in many repositories. The lesson for T1003.007 is that build runners are credential stores: pin actions by commit SHA, prefer short-lived federated tokens, and alert on cross-process memory reads on persistent runners. Read the tj-actions analysis.

Practitioner checklist

Collect Sysmon event 10 (or EDR equivalent) for lsass.exe on every Windows server, with a reviewed allowlist of signed images.
Turn on directory service access auditing with a SACL on the domain root so event 4662 records replication rights use, and alert on non-DC requesters.
Inventory every principal holding the two replication rights and remove any without a documented owner and purpose.
Alert on shadow copy creation and ntdsutil use on domain controllers outside the backup window and account.
Track WinInit event 12 to prove LSA protection is running, and alert when a host stops reporting it.
Add auditd rules for /etc/shadow reads and /proc/*/mem access on Linux servers and persistent CI runners.
Replace domain service accounts with gMSA where the application supports it.
Run authorised emulation of each sub-technique in a test environment each quarter and record which produced alerts.
Pre-write the rotation list per store: sessions for LSASS, local accounts for SAM, service accounts for LSA secrets, whole domain and krbtgt for NTDS or DCSync.

T1003 OS Credential Dumping