thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Credential Dumping

Extracting account credentials such as password hashes or plaintext passwords from an operating system or software.

Definition

Attackers dump credentials from LSASS memory, the SAM registry hive, NTDS.dit on domain controllers, cached credentials and browsers. Dumped hashes enable pass-the-hash and offline cracking. It is MITRE ATT&CK technique T1003 and is detected by monitoring access to LSASS and sensitive files.

Example

Using procdump to dump lsass.exe memory and then parsing it offline with Mimikatz.

Exam tip

Protecting LSASS (RunAsPPL, Credential Guard) is the key mitigation answer.

Related terms