domains / families / security / detecting-t1003-credential-dumping-with-edr

detecting-t1003-credential-dumping-with-edr

separate

Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM

When to use

• When hunting for credential theft activity in the environment
• After compromise indicators suggest attacker has elevated privileges
• When EDR alerts fire for LSASS access or suspicious process memory reads
• During incident response to determine scope of credential compromise
• When auditing LSASS protection controls (Credential Guard, RunAsPPL)

Skill page

Source