Forensia CTI Core

About

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.

Platforms: Linux, macOS, WindowsMITRE ATT&CK ↗

Used by actors

13 known groups

G0001 Axiom G0007 APT28 G0033 Poseidon Group G0039 Suckfly G0050 APT32 G0054 Sowbug G0065 Leviathan G0087 APT39 G0129 Mustang Panda G0131 Tonto Team G1003 Ember Bear G1043 BlackByte G1053 Storm-0501

Software

7 malware/tools implement this

CarbanakPinchDukeOnionDukeTrojan.KaraganyHOMEFRYRevenge RATMgBot

Corpus indicators tagged with this technique

405 indicators in the corpus carry T1003.

Indicator	Type	Family	Sev	Src
cve-2025-1055	cve	ransomware	85	3
cve-2023-52271	cve	ransomware	85	3
cve-2025-61155	cve	ransomware	85	3
72bed9b26a7747252156b65d24a9a737d70b9bf6aca069c514c1c7b9e04ef9b6	hash	ransomware	80	2
2528df60e55f210a6396dd7740d76afe30d5e9e8684a5b8a02a63bdcb5041bfc	hash	ransomware	80	2
6190923b28679eb8230010aff9b1d1a4184e8697540cc021a5be38126f3f6d99	hash	ransomware	80	2
442af2726e22f512b49f67bcdbf7c0d1e806aa8b	hash	ransomware	80	2
7ee17efef04bb7c9de90d5210263ed6993f867e5a11f86e65e3bb1362c7de237	sha256	ransomware	80	1
f1551d3e5d144eef4e70a29dd3dc52fb22459d1f	hash	—	80	2
01e3dce00ea45829bd9f6a583004976ac63973a0	hash	cryptojacking	80	1
3e62797fd746ce9bd5d49cb833b7d9ac62d6b7a2	hash	ransomware	80	2
308351124c496d4f4effee65ab828506abf70385773c167ab1f32a7f030385ac	hash	—	80	2
d78f64551d1b31a31e5998e442f0debd458e011e05019b3951d9ddde997f8384	hash	—	80	2
4e4a3751581252e210f6f45881d778d1f482146f92dc790504bfbcd2bdfa0129	hash	ransomware	80	2
54a6743781fd4ceb720331fce92f16186931192d	hash	ransomware	80	2
f0b3e112ce4807a28e2b5d66a840ed7f	hash	ransomware	80	2
edbf152ed9ac79e5d9e0111d1071af48	hash	ransomware	80	2
b0cfa2089802634ffb8c77962cdb18317a6332d4	hash	ransomware	80	2
64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983	hash	ransomware	80	2
43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2	hash	ransomware	80	2
6a69ea2ce3fea0ebfd7a32a1dfc4251bd4d7d8a4fbd44aaa47b82290d0414a9f	hash	—	80	2
7890b116d13a52efe696ce1e2c0ed83029775cf4bea836ce551e71d222ee116f	hash	ransomware	80	2
f962e15c6efebb3c29fe399bb168066042b616affddd83f72570c979184ec55c	hash	ransomware	80	2
6c700ca4e6d917c7aa9d964e98604a0349d9b8b4673df96a3f73a3d2d042635a	hash	—	80	2
28a9982cf2b4fc53a1545b6ed0d0c1788ca9369a847750f5652ffa0ca7f7b7d3	hash	ransomware	80	2
2b2e657ae1bc2fdcdfe5201a8e0e5224	hash	ransomware	80	2
8bd16897409ae5d5667c345276d2532f493c0f98	hash	ransomware	80	2
259fd28f9e66159d5a30b86688fec184	hash	ransomware	80	2
42a99a5effdc1d02f6b622537de881e1	hash	ransomware	80	2
b0e292346b4ab3f83fadd8abcce7cfc5b9d50ef73ad141e8bc4a4689fee13504	hash	ransomware	80	2

Showing the top 30 by severity of 405.