1. Home
  2. Techniques
  3. Enterprise
  4. 操作系统凭证转储

操作系统凭证转储

ID Name
T1003.001 内存驻留凭证提取
T1003.002 反射型DLL注入式凭证捕获
T1003.003 注册表隐蔽提取
T1003.004 合法进程内存寄生转储

操作系统凭证转储是攻击者通过内存读取、注册表解析或网络协议交互等手段获取系统登录凭证的攻击技术，通常作为横向移动和权限提升的关键环节。传统防御手段聚焦于监控敏感进程（如lsass.exe）的内存访问行为、检测注册表异常操作以及分析可疑的网络身份验证请求。典型缓解措施包括启用LSASS保护模式、监控SAM文件访问日志、部署内存完整性验证机制等。

为规避基于行为特征和日志分析的检测体系，攻击者发展出多维度隐匿技术：通过内存操作隐形化消除磁盘I/O特征，利用系统进程信任链绕过权限审查，借助加密通道和协议模拟隐藏数据外传行为，构建出"无接触、无特征、无日志"的新型凭证窃取范式。

当前凭证转储匿迹技术的核心逻辑聚焦于攻击链的深度解耦与系统信任机制的逆向利用。内存驻留技术通过代码注入与动态加密，将凭证提取过程融入合法进程的生命周期；反射型注入利用无文件特性规避静态检测，同时通过API劫持实现实时凭证捕获；注册表隐蔽提取则突破存储层防护，通过离线解析消除实时监控的有效性；合法进程寄生通过滥用系统管理工具构建攻击行为的"合法外衣"。这些技术的共性在于突破传统安全监控的观测维度：在空间维度上，通过内存驻留和进程寄生模糊攻击载体边界；在时间维度上，采用异步分阶段执行打散行为特征；在数据维度上，利用系统固有协议封装敏感信息流。攻击者通过重构凭证窃取的生命周期，使其每个阶段都具备与系统正常行为的强相似性。

匿迹技术的演进导致传统基于单一日志分析或行为特征匹配的防御体系面临失效风险，防御方需构建内存完整性验证、进程行为基线建模、跨层日志关联分析等能力，并引入硬件级可信执行环境（TEE）保护核心身份认证流程，实现对隐蔽凭证转储的全链路防护。

ID: T1003
Sub-techniques:  T1003.001, T1003.002, T1003.003, T1003.004
ⓘ
Tactic: 凭据获取
ⓘ
Platforms: Linux, Windows, macOS
Contributors: Ed Williams, Trustwave, SpiderLabs; Tim (Wadhwa-)Brown; Vincent Le Toux; Yves Yonan
Version: 2.2
Created: 31 May 2017
Last Modified: 15 October 2024

匿迹效应

效应类型 是否存在
特征伪装 ✅
行为透明 ✅
数据遮蔽 ✅
时空释痕 ❌

特征伪装

攻击者通过进程伪装和代码混淆技术，使凭证转储工具的行为特征与合法系统进程高度相似。例如将恶意代码注入具有微软数字签名的进程中，利用白名单信任机制绕过安全检测，或通过模拟系统管理工具的内存访问模式隐藏异常操作。

行为透明

利用零日漏洞（如未公开的LSASS内存读取漏洞）或未文档化的系统API，实现无日志记录的凭证提取。通过直接内核对象操作或硬件虚拟化扩展（如Intel VT-x）绕过用户层监控机制，使防御方无法感知关键安全组件的异常状态。

数据遮蔽

采用运行时内存加密和传输通道加密双重机制，对窃取的凭证数据进行全生命周期保护。在内存中使用流加密算法动态加密敏感数据，外传时通过TLS隧道或DNS隐蔽信道进行传输，有效对抗内存取证和网络流量分析。

Procedure Examples

ID Name Description
G0007 APT28

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.[1][2][3]

G0050 APT32

APT32 used GetPassword_x64 to harvest credentials.[4][5]
G0087 APT39

APT39 has used different versions of Mimikatz to obtain credentials.[6]
G0001 Axiom

Axiom has been known to dump credentials.[7]
S0030 Carbanak

Carbanak obtains Windows logon password details.[8]
G1003 Ember Bear

Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.[9]
S0232 HOMEFRY

HOMEFRY can perform credential dumping.[10]
G0065 Leviathan

Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.[11]
S1146 MgBot

MgBot includes modules for dumping and capturing credentials from process memory.[12]
S0052 OnionDuke

OnionDuke steals credentials from its victims.[13]
S0048 PinchDuke

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).[13]
G0033 Poseidon Group

Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.[14]
S0379 Revenge RAT

Revenge RAT has a plugin for credential harvesting.[15]
G0054 Sowbug

Sowbug has used credential dumping tools.[16]
G0039 Suckfly

Suckfly used a signed credential-dumping tool to obtain victim account credentials.[17]
G0131 Tonto Team

Tonto Team has used a variety of credential dumping tools.[18]

S0094 Trojan.Karagany

Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.[19]

Mitigations

ID Mitigation Description
M1015 Active Directory Configuration

Manage the access control list for "Replicating Directory Changes All" and other permissions associated with domain controller replication. [20] [21] Consider adding users to the "Protected Users" Active Directory security group. This can help limit the caching of users' plaintext credentials.[22]
M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing. [23]
M1043 Credential Access Protection

With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. [24] It also does not protect against all forms of credential dumping. [25]
M1041 Encrypt Sensitive Information

Ensure Domain Controller backups are properly secured.
M1028 Operating System Configuration

Consider disabling or restricting NTLM.[26] Consider disabling WDigest authentication.[27]
M1027 Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
M1026 Privileged Account Management

Windows:Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.[28]

Linux:Scraping the passwords from memory requires root privileges. Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive regions of memory.
M1025 Privileged Process Integrity

On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.[29]
M1017 User Training

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

Detection

ID Data Source Data Component Detects
DS0026 Active Directory Active Directory Object Access

Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync. [30] [31] [32] Note: Domain controllers may not log replication requests originating from the default domain controller account. [33]. Monitor for replication requests [34] from IPs not associated with known domain controllers. [20]

Analytic 1 - Suspicious Replication Requests

sourcetype=WinEventLog:Security EventCode="4662" AND AccessMask= "0x100" AND (guid= "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" OR guid= "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" OR guid= "9923a32a-3607-11d2-b9be-0000f87a36b2" OR guid= "89e95b76-444d-4c62-991a-0facbeda640c")

DS0017 Command Command Execution

Monitor executed commands and arguments that may attempt to dump credentials using tools like Mimikatz, ProcDump, NTDSUtil, or accessing /proc, /etc/passwd, and /etc/shadow.

Analytic 1 - Suspicious command execution involving credential dumping tools.(index=security sourcetype="WinEventLog:Security" EventCode=4688 Image IN ("mimikatz.exe", "procdump.exe", "ntdsutil.exe", "powershell.exe") CommandLine IN ("Invoke-Mimikatz", "Invoke-CachedCredentials", "Invoke-LSADump", "Invoke-SAMDump"))OR(index=security sourcetype="linux_secure" Command IN ("cat /etc/passwd", "cat /etc/shadow", "grep -E '^[0-9a-f-] r' /proc//maps"))OR(index=security sourcetype="macOS:UnifiedLog" process IN ("cat", "grep") message IN ("/etc/passwd", "/etc/shadow", "/var/db/shadow/hash/*", "/private/etc/master.passwd"))
DS0022 File File Access

Monitor file accesses that may indicate attempts to dump credential data from various storage locations such as LSASS memory, SAM, NTDS.dit, LSA secrets, cached domain credentials, proc filesystem, /etc/passwd, and /etc/shadow.

Analytic 1 - Unauthorized access to credential storage files.

(index=security sourcetype="WinEventLog:Security" EventCode=4663 ObjectName IN ("\config\SAM", "\ntds.dit", "\policy\secrets", "\cache"))OR (index=security sourcetype="auditd" (key="path" (value IN ("/etc/passwd", "/etc/shadow")) OR key="proctitle" value IN ("cat", "strings", "grep", "awk", "cut", "sed", "sort", "uniq", "head", "tail", "less", "more")))OR(index=security sourcetype="macOS:UnifiedLog" (process IN ("cat", "grep", "awk", "cut", "sed", "sort", "uniq", "head", "tail", "less", "more") OR message IN ("/etc/passwd", "/etc/shadow", "/var/db/shadow/hash/*", "/private/etc/master.passwd")))
File Creation

Monitor for the unexpected creation of memory dump files for processes that may contain credentials.

Analytic 1 - Unexpected memory dump file creation.

(index=security sourcetype="WinEventLog:Security" EventCode=4663 ObjectName IN ("lsass.dmp", "\config\SAM", "\ntds.dit", "\policy\secrets", "\cache"))OR (index=security sourcetype="linux_secure" (key="path" value IN ("/etc/passwd", "/etc/shadow")))OR (index=security sourcetype="macOS:UnifiedLog" message IN ("/var/db/shadow/hash/*", "/private/etc/master.passwd"))
DS0029 Network Traffic Network Traffic Content

Monitor for network protocols [30] [35] and other replication requests [34] from IPs not associated with known domain controllers. [20]

Analytic 1 - Anomalous network traffic content related to credential managers

index=network sourcetype="stream:tcp" dest_port=389 NOT [| inputlookup known_dc_ip_addresses | fields ip]| eval SourceIP = src_ip, DestinationIP = dest_ip, Protocol = proto| search (content="LDAPSearchRequest") OR (content="LDAPModifyRequest") OR (content="bindRequest") OR (content="searchResEntry") OR (content="NTDS.dit")
Network Traffic Flow

Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Analytic 1 - Unusual network communication patterns.

index=network sourcetype="stream:tcp" dest_port=389 NOT [| inputlookup known_dc_ip_addresses | fields ip]

DS0009 Process OS API Execution

Monitor for API calls that may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.
Process Access

Monitor for unexpected processes interacting with lsass.exe.[36] Common credential dumpers such as Mimikatz access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective Process Injection to reduce potential indicators of malicious activity.

Linux

To obtain the passwords and hashes stored in memory, processes must open a maps file in the /proc filesystem for the process being analyzed. This file is stored under the path /proc/<pid>/maps, where the <pid> directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs.

Analytic 1 - Unauthorized access to credential managers.

(index=security sourcetype="WinEventLog:Security" EventCode=10 TargetImage="lsass.exe" SourceImage IN ("mimikatz.exe", "procdump.exe"))OR (index=security sourcetype="linux_secure" (key="path" value IN ("/etc/passwd", "/etc/shadow")) (key="cmdline" value IN ("mimikatz", "procdump")))OR(index=security sourcetype="macOS:UnifiedLog" message IN ("/var/db/shadow/hash/", "/private/etc/master.passwd") process IN ("mimikatz", "procdump"))
Process Creation

Monitor for newly executed processes that may be indicative of credential dumping.

Analytic 1 - Unexpected process creation related to credential dumping.

(index=security sourcetype="WinEventLog:Security" EventCode=4688 Image="procdump.exe" CommandLine IN (" -ma lsass"))OR (index=security sourcetype="linux_secure" (key="cmdline" value IN ("procdump -ma /proc/$(pgrep lsass)")) (key="exe" value="procdump"))OR(index=security sourcetype="macOS:UnifiedLog" process="procdump" command=" -ma /proc/$(pgrep lsass)")
DS0024 Windows Registry Windows Registry Key Access

Monitor for the SAM registry key being accessed that may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Analytic 1 - Unauthorized registry access to SAM key.

index=security sourcetype="WinEventLog:Security" EventCode=4663 ObjectName="*\SAM" | where ProcessName IN ("mimikatz.exe", "procdump.exe", "reg.exe", "powershell.exe", "wmic.exe", "schtasks.exe", "cmd.exe")

References

  1. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  2. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
  3. Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.
  4. Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.
  5. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  6. Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020.
  7. Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
  8. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  9. Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.
  10. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  11. Plan, F., et al. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019.
  12. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.
  13. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  14. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  15. Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019.
  16. Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.
  17. DiMaggio, J. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.
  18. Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021.
  1. Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
  2. Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved December 4, 2017.
  3. Microsoft. (n.d.). How to grant the "Replicating Directory Changes" permission for the Microsoft Metadirectory Services ADMA service account. Retrieved December 4, 2017.
  4. Microsoft. (2016, October 12). Protected Users Security Group. Retrieved May 29, 2020.
  5. Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.
  6. Lich, B. (2016, May 31). Protect derived domain credentials with Credential Guard. Retrieved June 1, 2016.
  7. NSA IAD. (2017, April 20). Secure Host Baseline - Credential Guard. Retrieved April 25, 2017.
  8. Microsoft. (2012, November 29). Using security policies to restrict NTLM traffic. Retrieved December 4, 2017.
  9. Microsoft. (2014, May 13). Microsoft Security Advisory: Update to improve credentials protection and management. Retrieved June 8, 2020.
  10. Plett, C., Poggemeyer, L. (12, October 26). Securing Privileged Access Reference Material. Retrieved April 25, 2017.
  11. Microsoft. (2013, July 31). Configuring Additional LSA Protection. Retrieved February 13, 2015.
  12. Microsoft. (2017, December 1). MS-DRSR Directory Replication Service (DRS) Remote Protocol. Retrieved December 4, 2017.
  13. Microsoft. (n.d.). IDL_DRSGetNCChanges (Opnum 3). Retrieved December 4, 2017.
  14. SambaWiki. (n.d.). DRSUAPI. Retrieved December 4, 2017.
  15. Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved December 4, 2017.
  16. Microsoft. (n.d.). MS-SAMR Security Account Manager (SAM) Remote Protocol (Client-to-Server) - Transport. Retrieved December 4, 2017.
  17. Microsoft. (2017, December 1). MS-NRPC - Netlogon Remote Protocol. Retrieved December 6, 2017.
  18. French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019.