Add T1003 "OS credential dumping" MITRE technique reference #20533

cdelafuente-r7 · 2025-09-09T08:46:57Z

This adds the reference to MITRE ATT&CK technique T1003 "OS credential dumping". (see https://attack.mitre.org/techniques/T1003/ for details).

This has been mainly done with the help of AI and local scripts. The process was as follows:

Use both the source code and the documentation for each module in Metasploit.
Filter according to keywords related to the MITRE technique.
Process each module from the filtered list of modules using AI with a specific crafted prompt, the source code and the documentation.
Final manual review.

smcintyre-r7

Since this was our first time using AI to tag these I wanted to go through and review each of them. I think every module it tagged does indeed fall under the T1003 category; I didn't notice any false positives. While reviewing them I did add subcategories as I thought they were applicable just because I had the info handy. I did not go through modules that were not tagged, to see if there were any false negatives, but I can't think of any off hand that are obviously missing.

smcintyre-r7 · 2025-09-12T17:14:49Z

modules/auxiliary/admin/smb/psexec_ntdsgrab.rb

@@ -34,7 +34,8 @@ def initialize(info = {})
        'License' => MSF_LICENSE,
        'References' => [
          [ 'URL', 'http://sourceforge.net/projects/smbexec' ],
-          [ 'URL', 'https://www.optiv.com/blog/owning-computers-without-shell-access' ]
+          [ 'URL', 'https://www.optiv.com/blog/owning-computers-without-shell-access' ],
+          [ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]


Suggested change

[ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]

[ 'ATT&CK', Mitre::Attack::Technique::T1003_003_NTDS ]

smcintyre-r7 · 2025-09-12T17:15:01Z

modules/auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919.rb

@@ -34,7 +34,8 @@ def initialize(info = {})
          # Rapid7 ETR advisory for CVE-2024-24919
          [ 'URL', 'https://www.rapid7.com/blog/post/2024/05/30/etr-cve-2024-24919-check-point-security-gateway-information-disclosure/' ],
          # Publication of first proof-of-concept exploit
-          [ 'URL', 'https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/' ]
+          [ 'URL', 'https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/' ],
+          [ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]


Suggested change

[ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]

[ 'ATT&CK', Mitre::Attack::Technique::T1003_008_ETC_PASSWD_AND_ETC_SHADOW ]

smcintyre-r7 · 2025-09-12T17:15:15Z

modules/auxiliary/gather/fortios_vpnssl_traversal_creds_leak.rb

@@ -31,7 +31,8 @@ def initialize(info = {})
          %w[EDB 47288],
          ['URL', 'https://www.fortiguard.com/psirt/FG-IR-18-384'],
          ['URL', 'https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf'],
-          ['URL', 'https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/']
+          ['URL', 'https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/'],
+          ['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING]


Suggested change

['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING]

['ATT&CK', Mitre::Attack::Technique::T1003_008_ETC_PASSWD_AND_ETC_SHADOW]

smcintyre-r7 · 2025-09-12T17:15:46Z

modules/auxiliary/gather/qnap_lfi.rb

@@ -36,7 +36,8 @@ def initialize(info = {})
          ['EDB', '48531'],
          ['URL', 'https://infosecwriteups.com/qnap-pre-auth-root-rce-affecting-450k-devices-on-the-internet-d55488d28a05'],
          ['URL', 'https://www.qnap.com/en-us/security-advisory/nas-201911-25'],
-          ['URL', 'https://github.com/Imanfeng/QNAP-NAS-RCE']
+          ['URL', 'https://github.com/Imanfeng/QNAP-NAS-RCE'],
+          ['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING]


Suggested change

['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING]

['ATT&CK', Mitre::Attack::Technique::T1003_008_ETC_PASSWD_AND_ETC_SHADOW]

smcintyre-r7 · 2025-09-12T17:18:13Z

modules/auxiliary/gather/windows_secrets_dump.rb

@@ -68,6 +68,7 @@ module will fallback to the original implementation, which consists
        ],
        'References' => [
          ['URL', 'https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py'],
+          ['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING],


This one supports multiple techniques and it's one of the more important examples for each that I think it makes sense to add each one individually.

Suggested change

['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING],

['ATT&CK', Mitre::Attack::Technique::T1003_002_SECURITY_ACCOUNT_MANAGER],

['ATT&CK', Mitre::Attack::Technique::T1003_004_LSA_SECRETS],

['ATT&CK', Mitre::Attack::Technique::T1003_005_CACHED_DOMAIN_CREDENTIALS],

['ATT&CK', Mitre::Attack::Technique::T1003_006_DCSYNC]

smcintyre-r7 · 2025-09-12T17:22:55Z

modules/post/linux/gather/mimipenguin.rb

@@ -37,7 +37,8 @@ def initialize(info = {})
          [ 'URL', 'https://github.com/huntergregal/mimipenguin' ],
          [ 'URL', 'https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919' ],
          [ 'URL', 'https://bugs.launchpad.net/ubuntu/+source/lightdm/+bug/1717490' ],
-          [ 'CVE', '2018-20781' ]
+          [ 'CVE', '2018-20781' ],
+          [ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]


Suggested change

[ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]

[ 'ATT&CK', Mitre::Attack::Technique::T1003_007_PROC_FILESYSTEM ],

[ 'ATT&CK', Mitre::Attack::Technique::T1003_008_ETC_PASSWD_AND_ETC_SHADOW ]

smcintyre-r7 · 2025-09-12T17:23:28Z

modules/post/linux/gather/openvpn_credentials.rb

@@ -27,7 +27,8 @@ def initialize(info = {})
        'Platform' => ['linux'],
        'SessionTypes' => ['shell', 'meterpreter'],
        'References' => [
-          ['URL', 'https://gist.github.com/rvrsh3ll/cc93a0e05e4f7145c9eb#file-openvpnscraper-sh']
+          ['URL', 'https://gist.github.com/rvrsh3ll/cc93a0e05e4f7145c9eb#file-openvpnscraper-sh'],
+          [ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]


Suggested change

[ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]

[ 'ATT&CK', Mitre::Attack::Technique::T1003_007_PROC_FILESYSTEM ]

smcintyre-r7 · 2025-09-12T17:24:56Z

modules/post/solaris/gather/hashdump.rb

-        }
+        },
+        'References' => [
+          [ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]


Suggested change

[ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]

[ 'ATT&CK', Mitre::Attack::Technique::T1003_008_ETC_PASSWD_AND_ETC_SHADOW ]

smcintyre-r7 · 2025-09-12T17:25:35Z

modules/post/windows/gather/cachedump.rb

@@ -26,7 +26,8 @@ def initialize(info = {})
        'Platform' => ['win'],
        'SessionTypes' => ['meterpreter'],
        'References' => [
-          ['URL', 'https://web.archive.org/web/20220407023137/https://lab.mediaservice.net/code/cachedump.rb']
+          ['URL', 'https://web.archive.org/web/20220407023137/https://lab.mediaservice.net/code/cachedump.rb'],
+          ['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING]


Suggested change

['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING]

['ATT&CK', Mitre::Attack::Technique::T1003_005_CACHED_DOMAIN_CREDENTIALS]

smcintyre-r7 · 2025-09-12T17:26:11Z

modules/post/windows/gather/credentials/domain_hashdump.rb

-        }
+        },
+        'References' => [
+          [ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]


Suggested change

[ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]

[ 'ATT&CK', Mitre::Attack::Technique::T1003_003_NTDS ]

smcintyre-r7 · 2025-09-12T19:02:18Z

Actually I did find a few that I think should be tagged as well:

Add T1003 "OS credential dumping" MITRE technique

7ce2bdc

cdelafuente-r7 added the rn-enhancement release notes enhancement label Sep 9, 2025

cdelafuente-r7 changed the title ~~Add T1003 "OS credential dumping" MITRE technique~~ Add T1003 "OS credential dumping" MITRE technique reference Sep 9, 2025

smcintyre-r7 self-assigned this Sep 12, 2025

smcintyre-r7 added this to Metasploit Kanban Sep 12, 2025

github-project-automation bot moved this to Todo in Metasploit Kanban Sep 12, 2025

smcintyre-r7 moved this from Todo to In Progress in Metasploit Kanban Sep 12, 2025

smcintyre-r7 requested changes Sep 12, 2025

View reviewed changes

github-project-automation bot moved this from In Progress to Waiting on Contributor in Metasploit Kanban Sep 12, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add T1003 "OS credential dumping" MITRE technique reference #20533

Add T1003 "OS credential dumping" MITRE technique reference #20533

Uh oh!

cdelafuente-r7 commented Sep 9, 2025 •

edited

Loading

Uh oh!

smcintyre-r7 left a comment

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 Sep 12, 2025

Uh oh!

smcintyre-r7 commented Sep 12, 2025

Uh oh!

Uh oh!

	[ 'ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING ]
	[ 'ATT&CK', Mitre::Attack::Technique::T1003_003_NTDS ]

	['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING]
	['ATT&CK', Mitre::Attack::Technique::T1003_008_ETC_PASSWD_AND_ETC_SHADOW]

-          ['ATT&CK', Mitre::Attack::Technique::T1003_OS_CREDENTIAL_DUMPING],
+          ['ATT&CK', Mitre::Attack::Technique::T1003_002_SECURITY_ACCOUNT_MANAGER],
+          ['ATT&CK', Mitre::Attack::Technique::T1003_004_LSA_SECRETS],
+          ['ATT&CK', Mitre::Attack::Technique::T1003_005_CACHED_DOMAIN_CREDENTIALS],
+          ['ATT&CK', Mitre::Attack::Technique::T1003_006_DCSYNC]

Add T1003 "OS credential dumping" MITRE technique reference #20533

Are you sure you want to change the base?

Add T1003 "OS credential dumping" MITRE technique reference #20533

Uh oh!

Conversation

cdelafuente-r7 commented Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

smcintyre-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

smcintyre-r7 commented Sep 12, 2025

Uh oh!

Uh oh!

cdelafuente-r7 commented Sep 9, 2025 •

edited

Loading