OS Credential Dumping

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.^[2][3][4]

APT32 used GetPassword_x64 to harvest credentials.^[5][6]

APT39 has used different versions of Mimikatz to obtain credentials.^[7]

Axiom has been known to dump credentials.^[8]

BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems.^[9][10]

Carbanak obtains Windows logon password details.^[11]

Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.^[12]

HOMEFRY can perform credential dumping.^[13]

Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.^[14]

MgBot includes modules for dumping and capturing credentials from process memory.^[15]

Mustang Panda utilized "Hdump" to dump credentials from memory.^[16]

OnionDuke steals credentials from its victims.^[17]

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).^[17]

Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.^[18]

Revenge RAT has a plugin for credential harvesting.^[19]

Sowbug has used credential dumping tools.^[20]

Storm-0501 has used the SecretsDump module within Impacket can perform credential dumping to obtain account and password information.^[21]

Suckfly used a signed credential-dumping tool to obtain victim account credentials.^[22]

Tonto Team has used a variety of credential dumping tools.^[23]

Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.^[24]

Manage the access control list for "Replicating Directory Changes All" and other permissions associated with domain controller replication. ^{[25] [26]} Consider adding users to the "Protected Users" Active Directory security group. This can help limit the caching of users' plaintext credentials.^[27]

On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing. ^[28]

With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. ^[29] It also does not protect against all forms of credential dumping. ^[30]

Ensure Domain Controller backups are properly secured.

Consider disabling or restricting NTLM.^[31] Consider disabling WDigest authentication.^[32]

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

Windows:
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.^[33]

Linux:
Scraping the passwords from memory requires root privileges. Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive regions of memory.

On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.^[34]

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.