During the2016 Ukraine Electric Power Attack,Sandworm Team usedMimikatz to capture and use legitimate credentials.^[6]

Agrius used tools such asMimikatz to dump LSASS memory to capture credentials in victim environments.^[7]

APT1 has been known to use credential dumping usingMimikatz.^[8]

APT28 regularly deploys both publicly available (ex:Mimikatz) and custom password retrieval tools on victims.^[9][10] They have also dumped the LSASS process memory using the MiniDump function.^[11]

APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."^[12]

APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.^[13][14]

APT33 has used a variety of publicly available tools likeLaZagne,Mimikatz, and ProcDump to dump credentials.^[15][16]

APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.^[17]

APT41 has used hashdump,Mimikatz, Procdump, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.^[18][19][20]

APT5 has used the Task Manager process to target LSASS process memory in order to obtain NTLM password hashes.APT5 has also dumped clear text passwords and hashes from memory usingMimikatz hosted through an RDP mapped drive.^[21]

Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.^[22]

Bad Rabbit has usedMimikatz to harvest credentials from the victim's machine.^[23]

Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.^[24]

BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.^[25]

During theC0032 campaign,TEMP.Veles used Mimikatz and a custom tool, SecHack, to harvest credentials.^[26]

Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.^[27]

Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.^[28]

CozyCar has executedMimikatz to harvest stored credentials from the victim and further victim penetration.^[29]

DuringCutting Edge, threat actors used Task Manager to dump LSASS memory from Windows devices to disk.^[30]

Daserf leveragesMimikatz andWindows Credential Editor to steal credentials.^[31]

Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.^[32]

Ember Bear uses legitimate Sysinternals tools such as procdump to dump LSASS memory.^[33][34]

Emotet has been observed dropping and executing password grabber modules includingMimikatz.^[35][36]

Empire contains an implementation ofMimikatz to gather credentials from memory.^[37]

FIN13 has obtained memory dumps with ProcDump to parse and extract credentials from a victim's LSASS process memory withMimikatz.^[38][39]

FIN6 has usedWindows Credential Editor for credential dumping.^[40][41]

FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).^[42]

Fox Kitten has used prodump to dump credentials from LSASS.^[43]

GALLIUM used a modified version ofMimikatz along with a PowerShell-basedMimikatz to dump credentials on the victim machines.^[44][45]

GreyEnergy has a module forMimikatz to collect Windows credentials from the victim’s machine.^[46]

HAFNIUM has usedprocdump to dump the LSASS process memory.^[47][1][48]

DuringHomeLand Justice, threat actors dumped LSASS memory on compromised hosts.^[49]

SecretsDump andMimikatz modules withinImpacket can perform credential dumping to obtain account and password information.^[50]

Indrik Spider usedCobalt Strike to carry out credential dumping using ProcDump.^[51]

Ke3chang has dumped credentials, including by usingMimikatz.^[52][53][54]

Kimsuky has gathered credentials usingMimikatz and ProcDump.^[55][56][57]

LaZagne can perform credential dumping from memory to obtain account and password information.^[58]

Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.^[59]

Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.^[60]

Lizar can runMimikatz to harvest credentials.^[61][62]

Lslsass can dump active logon session password hashes from the lsass process.^[8]

Mafalda can dump password hashes fromLSASS.exe.^[63]

Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller usingMimikatz.^{[64][65][66][67]}

Medusa Group has leveragedMimikatz to dump LSASS to harvest credentials.^[68]

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.^{[69][70][71][72]}

Moonstone Sleet retrieved credentials from LSASS memory.^[73]

MuddyWater has performed credential dumping withMimikatz and procdump64.exe.^[74][75][76]

Mustang Panda has harvested credentials from memory of lssas.exe withMimikatz.^[77]

Net Crawler uses credential dumpers such asMimikatz andWindows Credential Editor to extract cached credentials from Windows systems.^[27]

NotPetya contains a modified version ofMimikatz to help gather credentials that are later used for lateral movement.^[78][79][72]

OilRig has used credential dumping tools such asMimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.^{[80][81][64][82]}

Okrum was seen using MimikatzLite to perform credential dumping.^[83]

Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar toMimikatz. These credentials are used withPsExec andWindows Management Instrumentation to help the malware propagate itself across a network.^[84]

DuringOperation Wocao, threat actors used ProcDump to dump credentials from memory.^[85]

PLATINUM has used keyloggers that are also capable of dumping credentials.^[86]

Play has usedMimikatz and the Windows Task Manager to dump LSASS process memory.^[87]

PoetRAT used voStro.exe, a compiled pypykatz (Python version ofMimikatz), to steal credentials.^[88]

PoshC2 contains an implementation ofMimikatz to gather credentials from memory.^[89]

PowerSploit contains a collection of Exfiltration modules that can harvest credentials usingMimikatz.^[90][91]

Pupy can execute Lazagne as well asMimikatz using PowerShell.^[92]

Pysa can perform OS credential dumping usingMimikatz.^[93]

Qilin can employ an embeddedMimikatz module to dump LSASS memory.^[94]

RedCurl usedLaZagne to obtain passwords from memory.^[95][96]

Sandworm Team has used its plainpwd tool, a modified version ofMimikatz, and comsvcs.dll to dump Windows credentials from system memory.^[97][98][99]

DuringSharePoint ToolShell Exploitation, threat actors usedMimikatz to dump LSASS memory.^[100]

Silence has used the Farse6.1 utility (based onMimikatz) to extract credentials from lsass.exe.^[101]

SILENTTRINITY can create a memory dump of LSASS via theMiniDumpWriteDump Win32 API call.^[102]

Sliver has a built-inprocdump command allowing for retrieval of memory from processes such aslsass.exe for credential harvesting.^[103]

Threat Group-3390 actors have used a modified version ofMimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.^[104][105]

In theTriton Safety Instrumented System Attack,TEMP.Veles used Mimikatz.^[106]

UNC3886 has used MiniDump to dump process memory and search for cleartext credentials.^[107]

Volt Typhoon has attempted to access hashed credentials from the LSASS process memory space.^[108][109]

Whitefly has usedMimikatz to obtain credentials.^[110]

Windows Credential Editor can dump credentials.^[111]

Wizard Spider has dumped the lsass.exe memory to harvest credentials with the use of open-source toolLaZagne.^[112]

On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.^[113]

With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.^[114][115]

Consider disabling or restricting NTLM.^[116] Consider disabling WDigest authentication.^[117]

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.^[118]

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

A non-privileged or abnormal process attempts to open a handle with full access (0x1F0FFF) to lsass.exe and subsequently invokes memory dump, file creation, or registry modification indicative of credential scraping. This behavior chain reflects staged credential theft activity.