Credential Dumping

Credential dumping is one of the most valuable moves in an attacker's playbook because it converts a single compromised machine into a master key. Instead of breaking through more defenses, the attacker simply steals the keys that legitimate users already hold, then walks through the front door as a trusted account. This is why credential access sits at the center of almost every serious intrusion, bridging the gap between an initial foothold and full control of an environment.

Where Credentials Are Stolen From

On a compromised system, login material lives in several predictable places, and each is a target:

• LSASS memory: the Windows process that caches credentials of logged-on users, including hashes and sometimes plaintext.
• The SAM database: the local store of account password hashes on a Windows host.
• Cached domain logins and credential managers: secrets kept so users do not retype them.
• Configuration files and scripts: hard-coded passwords and tokens left by administrators.

Once these are extracted, the attacker can crack the hashes offline or, more efficiently, reuse them directly through pass-the-hash and similar techniques. MITRE catalogs this behavior as OS Credential Dumping (T1003), one of the most heavily used techniques in the Credential Access tactic.

How It Fits the Attack Chain

Credential dumping rarely happens in isolation. It usually follows initial access and privilege escalation, because reading LSASS or the SAM database typically requires administrator or SYSTEM rights. With harvested credentials, the attacker then performs lateral movement, hopping from host to host as a legitimate user until they reach domain controllers or sensitive data.

Because the technique is so common, it is mapped in detail inside the MITRE ATT&CK framework, which security teams use to plan detections and measure coverage.

Detecting and Preventing It

Initial Access

→elevate

Privilege Escalation

→dump

Credential Dumping

→reuse

Lateral Movement

Defensively, the goal is to make a dump both hard to perform and worthless once stolen:

• Restrict and monitor access to LSASS, the SAM database, and credential stores.
• Enforce least privilege so few accounts can read credentials in the first place.
• Deploy endpoint detection that flags known dumping tools and memory reads.
• Require multi-factor authentication so a stolen hash alone cannot grant access.

A mature security operations center treats any sign of credential access as a high-priority lead, because catching a dump early can stop an intrusion before it spreads. In credential dumping, the attacker's whole advantage is invisibility, so the defender who watches the credential stores most closely is the one who wins.