CB detecting-t1003-credential-dumping-with-edr

# T1003 Credential Dumping Hunt Template

> An adversary with elevated privileges is dumping credentials from LSASS memory, SAM database, or NTDS.dit to enable lateral movement and privilege escalation.

3. **Investigate**: [Lateral movement from compromised credentials]

# API Reference: T1003 Credential Dumping Detection

## Sysmon Events for Credential Dumping

# Standards and References - T1003 Credential Dumping Detection

## MITRE ATT&CK Credential Dumping Sub-Techniques

## LSASS Access Masks for Credential Dumping

## Known Credential Dumping Tools

| LaZagne | Multi-source credential harvesting | lazagne.exe all |

# Detailed Hunting Workflow - T1003 Credential Dumping

## Phase 3: Post-Dump Lateral Movement

description: Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM

credential dumping.

# Detecting T1003 Credential Dumping with EDR

2. **Detect Credential Dumping Tools**: Hunt for known tool signatures -- Mimikatz (sekurlsa::logonpasswords), procdump.exe targeting LSASS, comsvcs.dll MiniDump, and Task Manager creating LSASS dumps

6. **Correlate with Lateral Movement**: After credential dumping, attackers typically move laterally. Correlate credential access events with subsequent remote logon attempts.