T1003Credential Access
OS Credential Dumping
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both…
CVEs18
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.18
Reports1
Detections
37 Sigma rules tagged T1003OS Credential DumpingT100337 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- HackTool - Rubeus Executioncriticalstable
- Hacktool Execution - Imphashcriticaltest
- Potential Credential Dumping Via LSASS Process Clonecriticaltest
- WCE wceaux.dll Accesscriticaltest
- HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdumphightest
- HackTool - Rubeus Execution - ScriptBlockhightest
- Hacktool Execution - PE Metadatahightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to OS Credential Dumping
18 CVEs, by priority. Each link shows its badge.- CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution VulnerabilityF5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more · 5 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%89.9priority
- CVE-2019-0604Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 4 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.03%88.8priority
- CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityIvanti · Connect Secure, Policy Secure, and ZTA GatewaysKEVRansomwarePublic exploitCritical · 9.0T1595Active ScanningT1190Exploit Public-Facing Application+4 more · 2 reportsMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.02%85.4priority
- CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity99.0%Top 0.07%83.7priority
- CVE-2021-22893Ivanti Pulse Connect Secure Use-After-Free VulnerabilityIvanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity47.2%Top 1.2%83.6priority
- CVE-2024-4577PHP-CGI OS Command Injection VulnerabilityPHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+10 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%79.9priority
- CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow VulnerabilityFortinet · Multiple ProductsKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1133External Remote Services+5 moreMITRE CTID mapping of the KEV entry · follow-on activity30.9%Top 1.7%79.5priority
- CVE-2023-28252Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1078Valid AccountsT1059Command and Scripting Interpreter+5 moreMITRE CTID mapping of the KEV entry · follow-on activity48.9%Top 1.1%78.2priority
- CVE-2024-57727SimpleHelp Path Traversal VulnerabilitySimpleHelp · SimpleHelpKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact96.8%Top 0.11%78.2priority
- CVE-2019-13608Citrix StoreFront Server XML External Entity (XXE) Processing VulnerabilityCitrix · StoreFront ServerKEVRansomwarePublic exploitHigh · 7.5T1078Valid AccountsT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · follow-on activity30.0%Top 1.8%77.9priority
- CVE-2019-11634Citrix Workspace Application and Receiver for Windows Remote Code Execution VulnerabilityCitrix · Workspace Application and Receiver for WindowsKEVRansomwareCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+5 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity8.1%Top 5.2%77.7priority
- CVE-2021-44515Zoho Desktop Central Authentication Bypass VulnerabilityZoho · Desktop CentralKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1003OS Credential Dumping+3 moreMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.04%69.9priority
- CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 moreMITRE CTID mapping of the KEV entry · follow-on activity93.3%Top 0.16%69.8priority
- CVE-2024-48248NAKIVO Backup and Replication Absolute Path Traversal VulnerabilityNAKIVO · Backup and ReplicationKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1003OS Credential Dumping+1 moreMITRE CTID mapping of the KEV entry · follow-on activity94.4%Top 0.15%69.0priority
- CVE-2025-21333Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1003OS Credential DumpingMITRE CTID mapping of the KEV entry · primary impact10.1%Top 4.4%67.6priority
- CVE-2025-32709Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact1.8%Top 21%64.2priority
- CVE-2025-21334Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1003OS Credential DumpingMITRE CTID mapping of the KEV entry · primary impact1.6%Top 25%58.5priority
- CVE-2025-21335Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1003OS Credential DumpingMITRE CTID mapping of the KEV entry · primary impact1.4%Top 28%58.0priority
Linked through a sub-technique
5 more- CVE-2024-24919Check Point Quantum Security Gateways Information Disclosure VulnerabilityCheck Point · Quantum Security GatewaysKEVRansomwarePublic exploitHigh · 8.6T1059.004Unix ShellT1202Indirect Command Execution+3 more>99.9%Top 0.02%79.0priority
- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 more97.3%Top 0.1%69.0priority
- CVE-2025-32706Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 more2.3%Top 16%65.2priority
- CVE-2025-32701Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 more1.4%Top 27%58.0priority
- CVE-2020-3240Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataCisco · Cisco UCS DirectorCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+4 more38.7%Top 1.4%26.6priority
Passages that support these links
Brute forcing RDP accounts, the dumping of credentials, and the use of *legacy* exploits such as EternalBlue (CVE-2017-0144), are ways to quickly obtain access to one or more privileged accounts.