Technique
technique:credential_dumping
Also: database dump, password harvesting, password list
Extraction of usernames and clear-text passwords from Windows memory using Mimikatz.
Extraction of usernames and clear-text passwords from Windows memory using Mimikatz.
“they were able to see the usernames and passwords of web developers and IT admins”
“the usernames and passwords that they harvested through Mimikatz”
Obtaining user databases, password lists, and account credentials from compromised systems.
“We just did backups of the database every day.”
The inferred technique of extracting usernames and passwords from Windows memory using Mimikatz.
“you can see their full password, too.”
“The more systems it gets into, the more usernames and passwords it collects”
Extraction of usernames and passwords from system memory using Mimikatz.
“we had about a hundred users with their clear text passwords”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | Las Vegas Sands cyber-attack | Explicit | 37 |
| incoming | USES | Dylan | Explicit | 45 |
| incoming | USES | Mimikatz | Explicit | 103 |
| incoming | INVOLVES | Cloud Hopper | Explicit | 103 |
Las Vegas Sands cyber-attack INVOLVES credential dumping
The attackers harvested usernames and clear-text passwords from the web development server using Mimikatz.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“they were able to see the usernames and passwords of web developers and IT admins for Sands Bethlehem”
Dylan USES credential dumping
Dylan used a database dump containing usernames, email addresses, and plaintext passwords.
Explicit Confidence 99% · Dylan EP 45 Details
“One day he gave me this list”
“usernames, e-mails, and plain text passwords”
Mimikatz USES credential dumping
Mimikatz was used to dump usernames and passwords from the compromised system.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“Mimikatz found a lot of passwords”
Cloud Hopper INVOLVES credential dumping
After entering the network, the attackers ran Mimikatz to collect credentials.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“it was then when Mimikatz was run where they grabbed all the credentials”