SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Malware

Credential-dumping tooling

Post-exploitation tools extracting cached credentials from memory

categoryMalwareseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: Mimikatz

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1003 · Dump Credential Manager using keymgr.dll and rundll32.exe · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1003 -TestGuids 84113186-ed3c-4d0d-8a3c-8980c86c1f4a -TimeoutSeconds 120'
ATT&CK T1003 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003 -Tool atomic -RunId run-2026-10-14-002 -Command 'Invoke-AtomicTest T1003 -TestGuids 84113186-ed3c-4d0d-8a3c-8980c86c1f4a -TimeoutSeconds 120'
ATT&CK T1003 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003 -Tool atomic -RunId run-2026-10-14-006 -Command 'Invoke-AtomicTest T1003 -TestGuids 84113186-ed3c-4d0d-8a3c-8980c86c1f4a -TimeoutSeconds 120'

+ 4 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-28 · detected in 6s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1Credential Manager dump via rundll32 keymgr,KRShowKeyMgr
Sysmon · EID 1Powershell process spawned powershell instance
Event · EID 102The database engine is starting a new instance.
Sysmon · EID 11C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe created a new scripting file under Windows Temp or User data folder
Sysmon · EID 11Executable file dropped in folder commonly used by malware
Event · EID 16384Software protection service scheduled successfully.
Event · EID 300The database engine is initiating recovery steps.
… and 14 more event type(s)

Detection that fired

  • ✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent
  • ✓ Wazuh 100400 (level 10) lab rule — Credential Manager dump via rundll32 keymgr,KRShowKeyMgr

Plus 22 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~133314 incidental alerts/hour — tune against this.

detected windows · 2026-10-27 · detected in 49s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Credential Manager dump via rundll32 keymgr,KRShowKeyMgr
Sysmon · EID 1Powershell process spawned powershell instance
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104Powershell script searching filesystem
PowerShell · EID 4104Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624Non network or service local logon.
… and 4 more event type(s)

Detection that fired

  • ✓ Wazuh 100400 (level 10) lab rule — Credential Manager dump via rundll32 keymgr,KRShowKeyMgr

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~69794 incidental alerts/hour — tune against this.

Classification

27 values: 3 lab-measured, 9 imported, 2 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vectorCredential attacksMalware
Reach (CVSS)Local
Attack complexityLow
Privileges requiredHigh
User interactionNone
Attacker skill requiredLow
Resources requiredLow
Likelihood / prevalenceHigh
MaturityCommoditized

Impact & scope

SeverityHigh
ImpactConfidentiality
PlatformLinuxmacOSWindows
EnvironmentOn-premises
Target asset classEndpointIdentity
Kill-chain phase (tactic)Credential Access

Detection & telemetry

Detectability (measured in our lab)Medium
Detectability (public detection content)High
Noise levelHigh
TestabilityAtomic Red Team test
Data sources (ATT&CK data components)Active Directory Object AccessFile AccessProcess AccessProcess CreationProcess Metadata

Detection & response

Mitigated by 57

  • M1015 attack-mitigation
  • M1017 attack-mitigation
  • M1025 attack-mitigation
  • M1026 attack-mitigation
  • M1027 attack-mitigation
  • M1028 attack-mitigation
  • M1040 attack-mitigation
  • M1041 attack-mitigation
  • M1043 attack-mitigation
  • D3-ABPI d3fend
  • D3-AEM d3fend
  • D3-ANAA d3fend
  • D3-ANCI d3fend
  • D3-APCA d3fend
  • D3-CAA d3fend
  • D3-CCSA d3fend
  • D3-CF d3fend
  • D3-CH d3fend
  • D3-CM d3fend
  • D3-CQ d3fend
  • D3-CR d3fend
  • D3-CRO d3fend
  • D3-CSPP d3fend
  • D3-CTS d3fend
  • D3-DF d3fend
  • D3-DI d3fend
  • D3-DUC d3fend
  • D3-FA d3fend
  • D3-FE d3fend
  • D3-FEV d3fend
  • D3-FIM d3fend
  • D3-HBPI d3fend
  • D3-HR d3fend
  • D3-HS d3fend
  • D3-KBPI d3fend
  • D3-LFP d3fend
  • D3-MFA d3fend
  • D3-NTCD d3fend
  • D3-NTF d3fend
  • D3-NTSA d3fend
  • … and 17 more in the database

Detected by 152

  • DET0234 attack-detection-strategy
  • 03e2746e-2b31-42f1-ab7a-eb39365b2422 sigma
  • 03f4ca17-de95-428d-a75a-4ee78b047256 sigma
  • 0442defa-b4a2-41c9-ae2c-ea7042fc4701 sigma
  • 060c3ef1-fd0a-4091-bf46-e7d625f60b73 sigma
  • 0685b176-c816-4837-8e7b-1216f346636b sigma
  • 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 sigma
  • 07f8bdc2-c9b3-472a-9817-5a670b872f53 sigma
  • 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a sigma
  • 0b8baa3f-575c-46ee-8715-d6f28cc7d33c sigma
  • 0e277796-5f23-4e49-a490-483131d4f6e1 sigma
  • 0f920ebe-7aea-4c54-b202-9aa0c609cfe5 sigma
  • 11b1ed55-154d-4e82-8ad7-83739298f720 sigma
  • 129966c9-de17-4334-a123-8b58172e664d sigma
  • 17d619c1-e020-4347-957e-1d1207455c93 sigma
  • 189e3b02-82b2-4b90-9662-411eb64486d4 sigma
  • 1a1ed54a-2ba4-4221-94d5-01dee560d71e sigma
  • 1af57a4b-460a-4738-9034-db68b880c665 sigma
  • 1de68c67-af5c-4097-9c85-fe5578e09e67 sigma
  • 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2 sigma
  • 23ceaf5c-b6f1-4a32-8559-f2ff734be516 sigma
  • 24e3e58a-646b-4b50-adef-02ef935b9fc8 sigma
  • 252902e3-5830-4cf6-bf21-c22083dfd5cf sigma
  • 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09 sigma
  • 2704ab9e-afe2-4854-a3b1-0c0706d03578 sigma
  • 2afafd61-6aae-4df4-baed-139fa1f4c345 sigma
  • 2d3cdeec-c0db-45b4-aa86-082f7eb75701 sigma
  • 2e65275c-8288-4ab4-aeb7-6274f58b6b20 sigma
  • 2e69f167-47b5-4ae7-a390-47764529eff5 sigma
  • 2f869d59-7f6a-4931-992c-cce556ff2d53 sigma
  • 2fcda7e2-8c57-4904-86ac-37fc3157e09d sigma
  • 3245cd30-e015-40ff-a31d-5cadd5f377ec sigma
  • 33b3cfb1-574e-44b9-b527-fbf9303b9d7b sigma
  • 33efc23c-6ea2-4503-8cfe-bdf82ce8f719 sigma
  • 34275eb8-fa19-436b-b959-3d9ecd53fa1f sigma
  • 36d88494-1d43-4dc0-b3fa-35c8fea0ca9d sigma
  • 37c1333a-a0db-48be-b64b-7393b2386e3b sigma
  • 39a94fd1-8c9a-4ff6-bf22-c058762f8014 sigma
  • 39f919f3-980b-4e6f-a975-8af7e507ef2b sigma
  • 3a8da4e0-36c1-40d2-8b29-b3e890d5172a sigma
  • … and 112 more in the database

Tested by 54

  • 0b207037-813c-4444-ac3f-b597cf280a67 atomic
  • 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 atomic
  • 0c0f5f06-166a-4f4d-bb4a-719df9a01dbb atomic
  • 129efd28-8497-4c87-a1b0-73b9a870ca3e atomic
  • 21748c28-2793-4284-9e07-d6d028b66702 atomic
  • 21c7bf80-3e8b-40fa-8f9d-f5b194ff2865 atomic
  • 21df41be-cdd8-4695-a650-c3981113aa3c atomic
  • 224f7de0-8f0a-4a94-b5d8-989b036c86da atomic
  • 2364e33d-ceab-4641-8468-bfb1d7cc2723 atomic
  • 2536dee2-12fb-459a-8c37-971844fa73be atomic
  • 2dfa3bff-9a27-46db-ab75-7faefdaca732 atomic
  • 3723ab77-c546-403c-8fb4-bb577033b235 atomic
  • 42510244-5019-48fa-a0e5-66c3b76e6049 atomic
  • 437b2003-a20d-4ed8-834c-4964f24eec63 atomic
  • 453acf13-1dbd-47d7-b28a-172ce9228023 atomic
  • 47a539d1-61b9-4364-bf49-a68bc2a95ef0 atomic
  • 5076874f-a8e6-4077-8ace-9e5ab54114a5 atomic
  • 542bb97e-da53-436b-8e43-e0a7d31a6c24 atomic
  • 55295ab0-a703-433b-9ca4-ae13807de12f atomic
  • 56506854-89d6-46a3-9804-b7fde90791f9 atomic
  • 5c2571d0-1572-416d-9676-812e64ca9f44 atomic
  • 60e860b6-8ae6-49db-ad07-5e73edd88f5d atomic
  • 6502c8f0-b775-4dbd-9193-1298f56b6781 atomic
  • 66fb0bc1-3c3f-47e9-a298-550ecfefacbc atomic
  • 6c7a4fd3-5b0b-4b30-a93e-39411b25d889 atomic
  • 7ae7102c-a099-45c8-b985-4c7a2d05790d atomic
  • 7cede33f-0acd-44ef-9774-15511300b24b atomic
  • 7e91138a-8e74-456d-a007-973d67a0bb80 atomic
  • 804f28fc-68fc-40da-b5a2-e9d0bce5c193 atomic
  • 84113186-ed3c-4d0d-8a3c-8980c86c1f4a atomic
  • 86fc3f40-237f-4701-b155-81c01c48d697 atomic
  • 96345bfc-8ae7-4b6a-80b7-223200f24ef9 atomic
  • 9d0072c8-7cca-45c4-bd14-f852cfa35cf0 atomic
  • 9d77fed7-05f8-476e-a81b-8ff0472c64d0 atomic
  • 9e2173c0-ba26-4cdf-b0ed-8c54b27e3ad6 atomic
  • a0bced08-3fc5-4d8b-93b7-e8344739376e atomic
  • a27418de-bdce-4ebd-b655-38f04842bf0c atomic
  • a90c2f4d-6726-444e-99d2-a00cd7c20480 atomic
  • a96872b2-cbf3-46cf-8eb4-27e8c0e85263 atomic
  • b385996c-0e7d-4e27-95a4-aca046b119a7 atomic
  • … and 14 more in the database

Attack relationships

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-14-002partially-detectedatomicwindows2026-10-14
run-2026-10-14-006partially-detectedatomicwindows2026-10-14
run-2026-10-16-001detectedatomicwindows2026-10-16
run-2026-10-18-005detectedatomicwindows2026-10-18
run-2026-10-27-033detectedatomicwindows2026-10-27
run-2026-10-28-011detectedatomicwindows2026-10-28
  • run-2026-10-14-002 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=7). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=13 max_level=15 dwell_s=90
  • run-2026-10-14-006 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=7). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=13 max_level=15 dwell_s=90
  • run-2026-10-16-001 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=7). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=13 max_level=15 dwell_s=90
  • run-2026-10-18-005 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=7). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=1 incidental=1549 max_level=15 dwell_s=90
  • run-2026-10-27-033 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=7). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=1 incidental=1803 max_level=15 dwell_s=90
  • run-2026-10-28-011 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=7). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=1 incidental=3518 max_level=15 dwell_s=90

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 116 of Cyber-Attack-Taxonomy.md
  • ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1003 as the nearest framework entries; ids verified to exist in the cached catalogues.
  • ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 20 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0004 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-002 (partially-detected) for T1003: no alert matched the expected technique
  • ev-0005 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-006 (partially-detected) for T1003: no alert matched the expected technique
  • ev-0006 (Phase 4 detection lab - detonation runs 2026-10-16) — Lab detonation run-2026-10-16-001 (detected): Wazuh rule(s) 100400 fired on T1003 within the detonation window
    Credential Manager dump via rundll32 keymgr,KRShowKeyMgr
  • ev-0007 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-005 (detected): Wazuh rule(s) 100400 fired on T1003 within the detonation window
    Credential Manager dump via rundll32 keymgr,KRShowKeyMgr
  • ev-0008 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-033 (detected): Wazuh rule(s) 100400 fired on T1003 within the detonation window
    Credential Manager dump via rundll32 keymgr,KRShowKeyMgr
  • ev-0009 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-011 (detected): Wazuh rule(s) 100400 fired on T1003 within the detonation window
    Credential Manager dump via rundll32 keymgr,KRShowKeyMgr