Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.1 Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
- Brining MimiKatz to Unix
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0039 | Suckfly | China |
| grp_g0054 | Sowbug | — |
| grp_g0033 | Poseidon Group | — |
| grp_g1043 | BlackByte | — |
| grp_g0129 | Mustang Panda | China |
| grp_g0001 | Axiom | China |
| grp_g0131 | Tonto Team | China |
| grp_g1053 | Storm-0501 | — |
| grp_g0065 | Leviathan | China |
| grp_g0087 | APT39 | — |
| grp_g1003 | Ember Bear | Russia |
| grp_g0007 | APT28 | Russia |
| grp_g0050 | APT32 | Vietnam |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.