{"id":3936,"date":"2022-05-02T21:30:07","date_gmt":"2022-05-02T19:30:07","guid":{"rendered":"https:\/\/jeffreyappel.nl\/?p=3936"},"modified":"2023-07-27T23:16:42","modified_gmt":"2023-07-27T21:16:42","slug":"detect-and-block-credential-dumps-with-defender-for-endpoint-attack-surface-reduction","status":"publish","type":"post","link":"https:\/\/jeffreyappel.nl\/detect-and-block-credential-dumps-with-defender-for-endpoint-attack-surface-reduction\/","title":{"rendered":"Detect and block Credential Dumps with Defender for Endpoint & Attack Surface Reduction"},"content":{"rendered":"\n

Credential dumping or password dump is a technique used by cybercriminals to gain access to a network. They will enter the workstation through phishing and controls through the typical way the admin uses and monitors the network to find more exposed credentials (Lateral movement).  Credential dumping is the process of obtaining account login password information, normally in the form of a hash or a clear text password, from the operating system layer and <\/strong>software layer<\/strong>. <\/p>\n\n\n\n

When attackers have established a foothold in a system, the main focus is to find high privileged credentials. Credentials are useful information, as they can give access to critical systems. Stealing user credentials is a key step for attackers to move laterally across victim networks. Important to protect and monitor any environment.<\/p>\n\n\n\n

What is credential dumping?<\/strong><\/h2>\n\n\n\n

Credential dumping (MITRE T1003<\/a>) refers to obtaining login information from a system’s operating system and software. There are a variety of places within operating systems where credentials are stored for use in everyday operations.<\/p>\n\n\n\n

The term credential dumping refers to any means of extracting or dumping user authentication credentials like usernames and passwords from a victim’s computer. This hacking technique is implemented after a computer has been breached by the attacker. Usernames and passwords are extremely valuable to cybercriminals and can be used to acquire sensitive information as well to gain more access to the complete network. <\/p>\n\n\n\n

Critical parts for credential dumping are located at the memory cache or application cache. The most common tool used is Mimikatz. Mimikatz became one of the world’s most used hack tools. <\/p>\n\n\n\n

Operation systems store passwords in memory, databases, or files to reduce the number of times a user is required to enter their password. Windows stores the password in the system memory\/LSA Subsystems Service. Credential dumping is largely possible because operating systems stores the password in the memory to avoid the user from repeatedly entering their password.<\/p>\n\n\n\n

Credential dumping can open the door to other credential-based attacks. (Pass the hash, Pass the Ticket (PTH), Kerberos Golden Ticket, Kerberos Silver Ticket<\/span>). <\/p>\n\n\n\n

Where to steal<\/strong><\/h2>\n\n\n\n

There are a variety of places within operating systems where credentials are stored for use in everyday operations. With access to an endpoint the victim can look for credentials in the below locations.<\/p>\n\n\n\n