What is Credential Dumping - Bitdefender TechZone
MITRE T1003.001 Credential Dumping recovers domain admin credentials via LSASS memory (ProcDump, comsvcs.dll, createdump.exe), DCSync replication impersonation, or SAM extraction, enabling Golden Ticket forgery and domain controller compromise without file-based signatures or kernel vulnerabilities.
Credential dumping (MITRE ATT&CK T1003.001) is a post-exploitation technique where attackers extract authentication credentials — password hashes, Kerberos tickets, or plaintext passwords — from memory or storage on a compromised system. Once stolen, these credentials enable lateral movement across the network, privilege escalation, and persistent access without triggering authentication failures. The technique exploits Windows authentication design rather than vulnerabilities, making it difficult to prevent through patching alone.
Credential Dumping Example
An IT admin troubleshoots a printer driver issue via Remote Desktop. The session is brief — fifteen minutes, no installations, no restarts. The ticket closes. Three days later, the security team investigates an alert: Event ID 10 logged an unusual process access request on lsass.exe from procdump.exe, requesting PROCESS_ALL_ACCESS rights (0x1FFFFF) — the maximum possible handle on the target process. The command was a single line:
procdump.exe -accepteula -ma lsass.exe lsass.dmp
The binary is a signed Microsoft Sysinternals utility, distributed by Microsoft and widely used by system administrators for legitimate crash diagnostics. It carries a valid Microsoft signature. The -ma flag instructs ProcDump to write a full memory dump of the target process — a diagnostic feature that attackers executes to capture the Local Security Authority Subsystem Service (LSASS), the Windows process responsible for authentication and credential caching. Signature-based detection never triggered and behavioral detection flagged the process access rights requested on lsass.exe.
The attacker parsed the dump offline and recovered the domain admin credentials cached from the RDP session. Three days after a routine support ticket closed, those credentials were used to authenticate to a domain controller and execute DCSync, extracting the entire domain credential.
What Credential Dumping Is
Credential dumping is not an exploit technique. It does not attack software vulnerability. It reads memory and storage that Windows maintains by design, using access rights that the operating system legitimately grants privileged processes. The attack is possible because Windows caches credentials in LSASS — password hashes and Kerberos tickets, the time-limited authentication tokens issued by a domain controller — to enable single sign-on. That is a architectural choice, not a flaw. LSASS runs as NT AUTHORITY\SYSTEM, the highest privilege level in Windows.
In most common variants the technique uses legitimate Windows APIs and signed Microsoft binaries. Detection depends on behavioral monitoring — which process requested which access rights on lsass.exe, which API was called, what file was written, and where.
How Credential Dumping Works
The two primary credential dumping methods that enable domain compromise operate at different layers: LSASS memory dumping targets the credential cache on individual hosts, while DCSync targets the Active Directory database directly by impersonating a domain controller. Beyond these, attackers also extract credentials from storage. The Security Account Manager (SAM) database stores local account password hashes and can be exported from the registry or copied via Volume Shadow Service (VSS) snapshots. The Active Directory database file (NTDS.dit) on domain controllers contains every domain user's password hash and is accessible to attackers with prior domain admin or local DC admin access via VSS. Windows caches up to ten domain login credentials in the registry by default for offline login; these MS-Cache v2 hashes cannot be used for Pass-the-Hash attacks directly but can be cracked offline.
LSASS Memory Dumping
The original tool that popularized this method was Mimikatz, a post-exploitation framework built to demonstrate Windows credential theft weaknesses. While Mimikatz is widely detected by signature-based antivirus, the underlying technique persists through Living off the Land (LOTL) variants using signed Windows binaries. ProcDump is one of the most common forms seen in enterprise intrusions:
procdump.exe -ma lsass.exe lsass.dmp
This writes a full memory dump through MiniDumpWriteDump, the Windows API that commits process memory to disk. The same outcome is reachable through other trusted paths: the comsvcs.dll MiniDump export invoked via rundll32.exe, or Task Manager's right-click "Create dump file" on lsass.exe. As detection caught up with the best-known of these, attackers rotated to less-watched signed binaries like createdump.exe or rdrleakdiag.exe. In every case, signature-based detection never triggers, because every binary is trusted.
DCSync: Domain Controller Impersonation
DCSync is a credential dumping technique that bypasses host-based defenses entirely. Instead of accessing files or memory on the domain controller, the attacker impersonates a domain controller and requests password hashes via Active Directory replication. From the domain controller's perspective, this looks like a legitimate replication event — another DC requesting a database update.
Active Directory replication uses the Directory Replication Service Remote Protocol (MS-DRSR), which domain controllers use to synchronize Active Directory databases. Any account with the "Replicating Directory Changes" and "Replicating Directory Changes All" permissions can initiate replication requests. By default, domain admins and members of certain privileged groups hold these permissions. An attacker with a compromised domain admin account can perform DCSync from any domain-joined system, including a workstation.
Mimikatz implements DCSync via lsadump::dcsync /domain:corp.local /user:krbtgt, requesting the password hash for the krbtgt account — the Kerberos ticket-granting service account. Possession of the krbtgt hash allows the attacker to forge Kerberos tickets (Golden Ticket attack), granting indefinite domain-wide access. No file is touched on the domain controller. No memory is read directly. The replication protocol does the work, and the protocol is functioning exactly as designed.
 |
Real-World Example
Curly COMrades, a threat actor aligned with Russian interests documented by Bitdefender Labs, August 2025, used Mimikatz, the comsvcs.dll-via-rundll32.exe method, ProcDump against a PID (procdump.exe -accepteula -ma 676), and a custom shellcode loader that called VirtualProtect and MiniDumpWriteDump to dump LSASS with no recognizable tool on disk.
Detection angle. The constant across every variant is a process opening lsass.exe with high access rights (Sysmon Event ID 10) and, usually, a dump file written outside C:\Windows\...\CrashDumps. Kernel-level monitoring of MiniDumpWriteDump catches the ones that avoid the standard binaries.
Common Mistakes and Misconceptions
“Credential dumping only works if the attacker has domain admin rights”
Credential dumping requires administrative rights, but not necessarily domain admin. An attacker with local admin on a single workstation can dump LSASS or the SAM database on that system, and if a privileged user — a domain admin or a service account with elevated rights — has logged in there, their credentials may be cached in LSASS memory.
 |
The attacker gains domain admin credentials by dumping the right workstation, not by starting as domain admin: initial access → local admin on a workstation → credential dumping → lateral movement to systems where more privileged accounts are cached → domain admin credentials recovered → domain-wide compromise.
“Disabling NTLM prevents credential dumping”
Disabling NTLM authentication prevents Pass-the-Hash attacks using NTLM hashes, but it does not prevent credential dumping itself. Attackers can still extract Kerberos tickets from LSASS memory and use them for Pass-the-Ticket attacks. They can still extract the krbtgt hash via DCSync and forge Golden Tickets. NTLM deprecation reduces the utility of stolen NTLM hashes; it does not eliminate credential theft as an attack vector. Disabling NTLM is a credential reuse mitigation, not a credential dumping mitigation.
“Mimikatz detection means credential dumping is blocked”
Signature-based detection of Mimikatz blocks one tool, not the technique. Attackers have migrated to LOTL variants — comsvcs.dll, ProcDump, Task Manager — and custom tooling that signature-based antivirus does not recognize. An environment that blocks Mimikatz but does not monitor LSASS access events remains vulnerable to credential dumping via any signed binary. Behavioral detection — monitoring process access rights on lsass.exe, API call patterns, and unusual file creation in non-standard directories — catches the technique regardless of which tool performs the dump.
What Reliable Credential Dumping Signals Look Like
The commands and binaries involved are legitimate, so detection rests on behavior: which process requested which rights on lsass.exe, which API was called, and what traffic a workstation sent toward domain controllers. Each signal below is rated against a standard Windows 10/11 and Windows Server 2016+ baseline with Sysmon deployed and Advanced Audit Policy configured.
Signal | Reliability | Notes |
|---|---|---|
Process access rights requested on lsass.exe (Sysmon Event ID 10) | High | The invariant across every dumping tool, signed or not; needs an allowlist for security and monitoring products. |
MiniDumpWriteDump calls (kernel-level API monitoring) | High | Underlies every LSASS dumping method regardless of invoking binary; catches tooling that skips the standard APIs. |
.dmp file creation outside standard crash dump paths | Medium | Legitimate diagnostic tools write dumps too; requires path filtering. |
Replication requests from non-DC sources (Event ID 4662) | High | Legitimate replication is DC-to-DC or sanctioned-sync only; produces nothing without a Domain Computers SACL. |
reg save on SAM or SYSTEM hives, vssadmin or wmic shadow copy creation, rundll32.exe comsvcs.dll | High with process context | SAM extraction, NTDS.dit theft, and LSASS dumping respectively; a helpdesk account running vssadmin is anomalous, a backup service account is not. |
Reliability High means the signal produces very few false positives in a standard enterprise environment. Reliability Medium means legitimate software triggers it, and tuning is required.
Mitigation
There is no patch for a design decision. Every control below works the same way instead: take the credentials out of reach, or limit where privileged ones are ever cached.
Enable Windows Defender Credential Guard. Credential Guard moves NTLM hashes and Kerberos TGTs out of LSASS memory into an isolated LSAIso.exe process protected by Virtualization-Based Security (VBS), preventing their extraction even by kernel-level code. It requires TPM 2.0, UEFI firmware, and CPU virtualization support. From Windows 11 22H2 and Windows Server 2025 it is enabled by default on domain-joined, non-DC systems meeting those requirements, but a device explicitly disabled before the upgrade stays disabled — verify with msinfo32.exe. It does not protect cached domain credentials (DCC2 hashes in the SECURITY registry hive); those require reducing CachedLogonsCount or Protected Users membership.
Add privileged accounts to the Protected Users security group. Protected Users blocks NTLM authentication for members, prevents credential caching, restricts Kerberos to AES (blocking the weaker RC4 and DES types), and hard-caps member TGT lifetimes at four hours with no renewal, shrinking the window a stolen ticket stays usable. Add domain admins and any account that authenticates to Tier 0 systems. Do not add service accounts — membership breaks any service that depends on NTLM or RC4 Kerberos, and protects nothing, because the service credential is always present on its host.
Enforce a tiered administration model. Tier 0 for domain admins, Tier 1 for server admins, Tier 2 for workstation admins, with Tier 0 accounts never logging into systems below their tier. This keeps domain admin credentials out of LSASS on lower-privilege machines and eliminates the workstation-dumping escalation path — the single most effective structural control against the lateral-movement chain this technique enables.
Apply least privilege and rotate credentials. Reduce the number of accounts with administrative rights; a dump on a system where no privileged account has logged in yields only low-value credentials. Rotate privileged and service account passwords regularly so stolen material has a short useful life. Rotate the krbtgt password twice, clearing both current and previous keys, to invalidate any forged Golden Tickets.
GravityZone Detection
Bitdefender GravityZone addresses credential dumping across multiple layers — from hardening the endpoint before an attack runs, to detecting the dump at execution, to correlating the full incident for the SOC.
Advanced Threat Control (ATC) is the layer that stopped the ProcDump attack in the demonstration. ATC monitors process behavior at runtime using behavioral heuristics and machine learning, with a dedicated category for credential access covering LSASS dumping and SAM registry access. It flagged procdump64.exe on execution and remediated it automatically, raising the ATC.Malicious detection. Because the detection starts on the behavior — a signed binary acquiring privileged access rights on lsass.exe — and not on the tool's identity, it fires the same way against any signed binary performing the same action. ATC's process injection heuristics cover the related path: the reflective injection of EggStremeAgent into winlogon.exe and MsMpEng.exe is exactly the class of behavior they are built to surface.
Fileless Protection covers the memory-only and LOTL variants that leave little trace on disk. The AMSI Security Provider scans and de-obfuscates scripts before execution; the proprietary Command-Line Scanner analyzes command-line activity for fileless patterns and blocks malicious commands pre-execution, remaining effective where AMSI is bypassed or unavailable. For credential dumping, this intercepts LOTL chains — a rundll32.exe comsvcs.dll MiniDump invocation, a PowerShell extraction routine — before the dump is written.
Proactive Hardening and Attack Surface Reduction (PHASR) prevents the dumping tool from running at all when its use falls outside a user's normal behavior. ProcDump falls under PHASR's Tampering Tools category; the SysInternalsProcdumpGenericUsage rule blocks the demonstrated command on any endpoint where the logged-in user has no history of legitimately running ProcDump.
EDR Sensor and Correlation Engine record each discrete action and correlate them into a single incident — the graph in the demonstration, tracing ancestry down to procdump.exe. In the demo: ProcdumpProcessExecuted, SuspiciousSignedProcessExecution, DebugPrivilegesEnabled, ProcessEnumeration.NativeAPI, and AccessTokenModified. Read individually, each is low-signal; correlated, they describe a credential-access attempt end to end.
Integrity Monitoring covers the registry-based paths. When an attacker runs reg save HKLM\SAM, it tracks the change against a known-good baseline and alerts when monitored registry paths are accessed outside expected behavior.
Related Resources
EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company, Business Insights — Bitdefender Labs investigation documenting SeDebugPrivilege abuse, reflective injection into trusted processes, and fileless credential access in a Chinese APT campaign.
Deep Dive Into Unfading Sea Haze: A New Threat Actor in the South China Sea, Business Insights — forensic analysis of AMSI and ETW patching used to bypass credential access detection in a long-running espionage campaign.