{"record":{"id":"ATTACK:enterprise:T1003","title":"OS Credential Dumping","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1003","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22","external_id":"T1003","domain":"enterprise","created":"2017-05-31T21:30:19.735Z","modified":"2025-10-24T17:48:22.201Z","version":"2.2","aliases":[],"tactics":["credential-access"],"source_references":[{"source_name":"Medium Detecting Attempts to Steal Passwords from Memory","url":"https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea"},{"source_name":"AdSecurity DCSync Sept 2015","url":"https://adsecurity.org/?p=1729"},{"source_name":"Microsoft DRSR Dec 2017","url":"https://msdn.microsoft.com/library/cc228086.aspx"},{"source_name":"Microsoft NRPC Dec 2017","url":"https://msdn.microsoft.com/library/cc237008.aspx"},{"source_name":"Microsoft GetNCCChanges","url":"https://msdn.microsoft.com/library/dd207691.aspx"},{"source_name":"Microsoft SAMR","url":"https://msdn.microsoft.com/library/cc245496.aspx"},{"source_name":"Powersploit","url":"https://github.com/mattifestation/PowerSploit"},{"source_name":"Samba DRSUAPI","url":"https://wiki.samba.org/index.php/DRSUAPI"},{"source_name":"Harmj0y DCSync Sept 2015","url":"http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/"},{"source_name":"Brining MimiKatz to Unix","url":"https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf"}]},"assertions":[{"id":"enterprise:relationship--0314a845-98db-4cf9-ac05-875025017636","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0314a845-98db-4cf9-ac05-875025017636","modified":"2026-07-31T18:48:12.857Z","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--050b13e6-22e2-450c-a075-44a79fb79dc9","subject":"ATTACK:enterprise:T1003.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--050b13e6-22e2-450c-a075-44a79fb79dc9","modified":"2026-04-29T14:23:05.910Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f93a49a-11c8-49d8-9b58-e7136e6bc850","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f93a49a-11c8-49d8-9b58-e7136e6bc850","modified":"2026-07-31T18:47:53.145Z","references":[{"source_name":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13910722-9dc6-499f-9fbf-0a9cb3daab11","subject":"ATTACK:enterprise:S0030","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13910722-9dc6-499f-9fbf-0a9cb3daab11","modified":"2026-04-29T14:23:05.931Z","references":[{"source_name":"FireEye CARBANAK June 2017","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ef7da45-bf8c-4483-865e-2a1d58f57bb0","subject":"ATTACK:enterprise:S1146","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ef7da45-bf8c-4483-865e-2a1d58f57bb0","modified":"2026-04-29T14:23:05.947Z","references":[{"source_name":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--21537040-e89a-4908-95c2-2c5d905bcc2f","subject":"ATTACK:enterprise:S0379","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--21537040-e89a-4908-95c2-2c5d905bcc2f","modified":"2026-04-29T14:23:05.950Z","references":[{"source_name":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2e80a049-220e-4d47-98f7-c0dbfe245cdc","subject":"ATTACK:enterprise:S0048","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2e80a049-220e-4d47-98f7-c0dbfe245cdc","modified":"2026-04-29T14:23:05.967Z","references":[{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--35aac341-5371-42e8-ad93-3ab94a11b51a","subject":"ATTACK:enterprise:G0033","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--35aac341-5371-42e8-ad93-3ab94a11b51a","modified":"2026-07-31T18:48:05.179Z","references":[{"source_name":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37ad61e7-6520-47d0-81ae-f3d129b49ac1","subject":"ATTACK:enterprise:S0052","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37ad61e7-6520-47d0-81ae-f3d129b49ac1","modified":"2026-04-29T14:23:05.996Z","references":[{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--386a591e-3e8e-4f23-8a5c-60abfa831d30","subject":"ATTACK:enterprise:T1003.004","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--386a591e-3e8e-4f23-8a5c-60abfa831d30","modified":"2026-04-29T14:23:05.997Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d8b368c-57bc-4f36-808a-387a1e2cd3d9","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d8b368c-57bc-4f36-808a-387a1e2cd3d9","modified":"2026-07-31T18:47:52.082Z","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3e3f06c4-3105-4d07-b876-702005e9b59a","subject":"ATTACK:enterprise:M1041","predicate":"mitigates","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3e3f06c4-3105-4d07-b876-702005e9b59a","modified":"2026-04-29T14:23:06.010Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e43af09-b4bb-46dc-87f3-e2b72e70b47a","subject":"ATTACK:enterprise:G0131","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e43af09-b4bb-46dc-87f3-e2b72e70b47a","modified":"2026-07-31T18:48:18.914Z","references":[{"source_name":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f75cf7f-1c21-4c22-983b-fac20ea85101","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f75cf7f-1c21-4c22-983b-fac20ea85101","modified":"2026-07-31T18:47:44.674Z","references":[{"source_name":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--782ee381-61f2-4405-b399-9faa99d00fea","subject":"ATTACK:enterprise:M1040","predicate":"mitigates","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--782ee381-61f2-4405-b399-9faa99d00fea","modified":"2026-04-29T14:23:06.089Z","references":[{"source_name":"win10_asr","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a3426bf-1751-43db-b844-6bf388a4c817","subject":"ATTACK:enterprise:M1027","predicate":"mitigates","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a3426bf-1751-43db-b844-6bf388a4c817","modified":"2026-04-29T14:23:06.092Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ad1bbdf-4a00-426a-b130-fb4425ad2622","subject":"ATTACK:enterprise:S0232","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ad1bbdf-4a00-426a-b130-fb4425ad2622","modified":"2026-04-29T14:23:06.093Z","references":[{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e8ca453-aee5-48c1-a891-f44a742a95ed","subject":"ATTACK:enterprise:M1017","predicate":"mitigates","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e8ca453-aee5-48c1-a891-f44a742a95ed","modified":"2026-04-29T14:23:06.098Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9dc0d9c5-1701-47b7-971f-4a1992203776","subject":"ATTACK:enterprise:T1003.006","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9dc0d9c5-1701-47b7-971f-4a1992203776","modified":"2026-04-29T14:23:06.140Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a0c55c8d-6192-4faa-a5a2-1742fb5815a0","subject":"ATTACK:enterprise:G0039","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a0c55c8d-6192-4faa-a5a2-1742fb5815a0","modified":"2026-07-31T18:47:58.038Z","references":[{"source_name":"Symantec Suckfly May 2016","url":"http://www.symantec.com/connect/blogs/indian-organizations-targeted-suckfly-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a266294c-18a7-4a6e-8291-a901748c929c","subject":"ATTACK:enterprise:M1026","predicate":"mitigates","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a266294c-18a7-4a6e-8291-a901748c929c","modified":"2026-04-29T14:23:06.146Z","references":[{"source_name":"Microsoft Securing Privileged Access","url":"https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#a-nameesaebmaesae-administrative-forest-design-approach"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6f27258-cf6a-4d75-a3f0-5de085d528d2","subject":"ATTACK:enterprise:M1025","predicate":"mitigates","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6f27258-cf6a-4d75-a3f0-5de085d528d2","modified":"2026-04-29T14:23:06.152Z","references":[{"source_name":"Microsoft LSA","url":"https://technet.microsoft.com/en-us/library/dn408187.aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7752cff-83f3-4a19-b92a-77201882cea4","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7752cff-83f3-4a19-b92a-77201882cea4","modified":"2026-07-31T18:47:36.358Z","references":[{"source_name":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9ad8c47-9cec-45c1-8d07-6154d2cc752b","subject":"ATTACK:enterprise:T1003.007","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9ad8c47-9cec-45c1-8d07-6154d2cc752b","modified":"2026-04-29T14:23:06.156Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b149adfe-547f-4cd4-af4a-ea7018a203c1","subject":"ATTACK:enterprise:S0094","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b149adfe-547f-4cd4-af4a-ea7018a203c1","modified":"2026-04-29T14:23:06.167Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c53e4807-05e4-46d2-9cb9-fd6301ac3738","subject":"ATTACK:enterprise:T1003.003","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c53e4807-05e4-46d2-9cb9-fd6301ac3738","modified":"2026-04-29T14:23:06.195Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7e8689c-25cf-4fac-926e-c55a2414f16c","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7e8689c-25cf-4fac-926e-c55a2414f16c","modified":"2026-07-31T20:48:45.103Z","references":[{"source_name":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d5afd2ff-ca7f-4a53-b2ca-1628fda6f74d","subject":"ATTACK:enterprise:T1003.005","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d5afd2ff-ca7f-4a53-b2ca-1628fda6f74d","modified":"2026-04-29T14:23:06.217Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d93265a6-1f92-472b-9e47-48b7863d8171","subject":"ATTACK:enterprise:G0054","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d93265a6-1f92-472b-9e47-48b7863d8171","modified":"2026-07-31T18:48:21.367Z","references":[{"source_name":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee212490-822c-4851-bf2f-06b8179a9a38","subject":"ATTACK:enterprise:T1003.001","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee212490-822c-4851-bf2f-06b8179a9a38","modified":"2026-04-29T14:23:06.249Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee8ef62a-fcde-44b0-aa63-4028dad703aa","subject":"ATTACK:enterprise:M1043","predicate":"mitigates","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee8ef62a-fcde-44b0-aa63-4028dad703aa","modified":"2026-04-29T14:23:06.250Z","references":[{"source_name":"TechNet Credential Guard","url":"https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard"},{"source_name":"GitHub SHB Credential Guard","url":"https://github.com/iadgov/Secure-Host-Baseline/tree/master/Credential%20Guard"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8f09842-7360-461d-98b6-b1e9e6a77332","subject":"ATTACK:enterprise:G1053","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8f09842-7360-461d-98b6-b1e9e6a77332","modified":"2026-07-31T18:48:04.055Z","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fad2a504-6e00-4892-bf88-b49d6d18788c","subject":"ATTACK:enterprise:G0001","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fad2a504-6e00-4892-bf88-b49d6d18788c","modified":"2026-07-31T18:48:12.535Z","references":[{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fbcd00ef-0518-414d-9026-b736f036606a","subject":"ATTACK:enterprise:G0065","predicate":"uses","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fbcd00ef-0518-414d-9026-b736f036606a","modified":"2026-07-31T20:48:38.523Z","references":[{"source_name":"FireEye APT40 March 2019","url":"https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc31837d-530f-45e5-b9f8-bf6268c3ef03","subject":"ATTACK:enterprise:M1015","predicate":"mitigates","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc31837d-530f-45e5-b9f8-bf6268c3ef03","modified":"2026-04-29T14:23:06.267Z","references":[{"source_name":"AdSecurity DCSync Sept 2015","url":"https://adsecurity.org/?p=1729"},{"source_name":"Microsoft Protected Users Security Group","url":"https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group"},{"source_name":"Microsoft Replication ACL","url":"https://support.microsoft.com/help/303972/how-to-grant-the-replicating-directory-changes-permission-for-the-micr"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fe061ca4-3182-49b7-a70c-96c58e19d9bc","subject":"ATTACK:enterprise:T1003.008","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fe061ca4-3182-49b7-a70c-96c58e19d9bc","modified":"2026-04-29T14:23:06.270Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fe849763-78b9-4b8a-9219-2781ac7b00e8","subject":"ATTACK:enterprise:M1028","predicate":"mitigates","object":"ATTACK:enterprise:T1003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fe849763-78b9-4b8a-9219-2781ac7b00e8","modified":"2026-04-29T14:23:06.271Z","references":[{"source_name":"Microsoft Disable NTLM Nov 2012","url":"https://technet.microsoft.com/library/jj865668.aspx"},{"source_name":"Microsoft WDigest Mit","url":"https://support.microsoft.com/en-us/help/2871997/microsoft-security-advisory-update-to-improve-credentials-protection-a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}