> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping.md).

# Credential Dumping

**ATT\&CK ID:** [T1003](https://attack.mitre.org/techniques/T1003/)

**Description**

Adversaries could attempt to extract credentials and account hashes from various areas of the Operating System. Clear-text passwords and hashes can be used by adversaries to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) in the environment.

## Sub Techniques

### T1003.001: LSASS Memory

{% content-ref url="/pages/p638AABkhSfL9iTFnsAG" %}
[LSASS Memory](/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/lsass-memory.md)
{% endcontent-ref %}

### T1003.002: Security Account Manager (SAM)

{% content-ref url="/pages/yjnyelPKDYwwrMmLFpmf" %}
[Security Account Manager (SAM)](/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/security-account-manager-sam.md)
{% endcontent-ref %}

### T1003.003: NTDS

{% content-ref url="/pages/gOXsUaqCCRZtWYGFUcUf" %}
[NTDS](/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/ntds.md)
{% endcontent-ref %}

### T1003.004: LSA Secrets

{% content-ref url="/pages/gpdmEWU8bviIJi1SRc4C" %}
[LSA Secrets](/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/lsa-secrets.md)
{% endcontent-ref %}

### T1003.005: Cached Domain Credentials

{% content-ref url="/pages/caBjUGKPeF4DQJhOTz4g" %}
[Cached Domain Credentials](/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/cached-domain-credentials.md)
{% endcontent-ref %}

### T1003.006: DCSync

{% content-ref url="/pages/i9RC7Q3RdNY5V105svOn" %}
[DCSync](/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/dcsync.md)
{% endcontent-ref %}