value:  Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory. ;; BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping. ;; Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor. ;; CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration. ;; Daserf leverages Mimikatz and Windows Credential Editor to steal credentials. ;; Emotet has been observed dropping password grabber modules including Mimikatz. ;; Empire contains an implementation of Mimikatz to gather credentials from memory. ;; FIN6 has used Windows Credential Editor for credential dumping. ;; FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE). ;; Fox Kitten has used prodump to dump credentials from LSASS. ;; GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines. ;; GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine. ;; HAFNIUM has used procdump to dump the LSASS process memory. ;; SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information. ;; Ke3chang has dumped credentials including by using Mimikatz. ;; Kimsuky has used ProcDump to dump credentials. ;; LaZagne can perform credential dumping from memory to obtain account and password information. ;; Lazarus Group leveraged Mimikatz to extract Windows Credentials of currently logged-in users and steals passwords stored in browsers. Lazarus Group has also used a custom version Mimikatz to capture credentials. ;; Leafminer used several tools for retrieving login and password information including LaZagne and Mimikatz. ;; Leviathan has used publicly available tools to dump password hashes including ProcDump and WCE. ;; Lslsass can dump active logon session password hashes from the lsass process. ;; Magic Hound stole domain credentials from Microsoft Active Directory Domain Controller and leveraged Mimikatz. ;; Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways including from the LSASS Memory. ;; MuddyWater has performed credential dumping with Mimikatz and procdump64.exe. ;; Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems. ;; NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement. ;; OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access. ;; Okrum was seen using MimikatzLite to perform credential dumping. ;; Olympic Destroyer contains a module that tries to obtain credentials from LSASS similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network. ;; Operation Wocao has used ProcDump to dump credentials from memory. ;; PLATINUM has used keyloggers that are also capable of dumping credentials. ;; PoetRAT used voStro.exe a compiled pypykatz (Python version of Mimikatz) to steal credentials. ;; PoshC2 contains an implementation of Mimikatz to gather credentials from memory. ;; PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz. ;; Pupy can execute Lazagne as well as Mimikatz using PowerShell. ;; Pysa can perform OS credential dumping using Mimikatz. ;; Sandworm Team's plainpwd tool is a modified version of Mimikatz and dumps Windows credentials from system memory. ;; Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe. ;; Stolen Pencil gathers credentials using Mimikatz and Procdump. ;; TEMP.Veles has used Mimikatz and a custom tool SecHack to harvest credentials. ;; Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers. ;; Whitefly has used Mimikatz to obtain credentials. ;; Windows Credential Editor can dump credentials."
name: OS Credential Dumping: Lsass Memory