// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Techniques › T1003
Technique T1003

OS Credential Dumping

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
OS Credential Dumping (T1003) — a Credential Access technique, observed in public incident reporting.
MITRE ATT&CKT1003
TacticCredential Access
Incidents on file9

Detection & mitigation

Monitor for suspicious access to LSASS or DPAPI where WHFB keys are stored, such as unexpected process access or credential export tools. Enforce conditional access policies and investigate anomalous Entra ID authentications lacking MFA or biometric prompts.

Observed in the wild

2026-08-07
lsass credential dumping
Windows Hello for Business Key Abuse Enables Unauthorized Entra ID Authentication
2026-08-03
lsass credential dumping
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts
2026-05-13
lsass credential dumping
Researcher Discloses Two Microsoft Zero-Day Vulnerabilities Including Credential Dumping Bypass
2026-05-10
lsass credential dumping
PamDOORa Linux Backdoor Uses Malicious PAM Module to Steal SSH Credentials
2026-05-06
lsass credential dumping
VoidStealer Malware Bypasses Google Chrome's App-Bound Encryption
2026-04-27
lsass credential dumping
AI-Driven Variant Analysis Bypasses Defender for Endpoint SAM Hive Extraction Detection
2025-09-04
lsass credential dumping
Raw Disk Reads Used to Bypass EDR and Access Sensitive Files
2025-07-08
lsass credential dumping
CVE-2025-6995: Ivanti Endpoint Manager Agent Password Decryption Vulnerability
2025-06-13
lsass credential dumping
Kernel-Level LSA Protection Bypass Enables LSASS Credential Dumping

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →