Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.

Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

OS Credential Dumping
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1003  external_id: T1003     source_name: Medium Detecting Attempts to Steal Passwords from Memory  description: French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019.  url: https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea     source_name: AdSecurity DCSync Sept 2015  description: Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved December 4, 2017.  url: https://adsecurity.org/?p=1729     source_name: Microsoft DRSR Dec 2017  description: Microsoft. (2017, December 1). MS-DRSR Directory Replication Service (DRS) Remote Protocol. Retrieved December 4, 2017.  url: https://msdn.microsoft.com/library/cc228086.aspx     source_name: Microsoft NRPC Dec 2017  description: Microsoft. (2017, December 1). MS-NRPC - Netlogon Remote Protocol. Retrieved December 6, 2017.  url: https://msdn.microsoft.com/library/cc237008.aspx     source_name: Microsoft GetNCCChanges  description: Microsoft. (n.d.). IDL_DRSGetNCChanges (Opnum 3). Retrieved December 4, 2017.  url: https://msdn.microsoft.com/library/dd207691.aspx     source_name: Microsoft SAMR  description: Microsoft. (n.d.). MS-SAMR Security Account Manager (SAM) Remote Protocol (Client-to-Server) - Transport. Retrieved December 4, 2017.  url: https://msdn.microsoft.com/library/cc245496.aspx     source_name: Powersploit  description: PowerSploit. (n.d.). Retrieved December 4, 2014.  url: https://github.com/mattifestation/PowerSploit     source_name: Samba DRSUAPI  description: SambaWiki. (n.d.). DRSUAPI. Retrieved December 4, 2017.  url: https://wiki.samba.org/index.php/DRSUAPI     source_name: Harmj0y DCSync Sept 2015  description: Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved December 4, 2017.  url: http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/     source_name: Brining MimiKatz to Unix  description: Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.  url: https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf     