BIOC
Medium
✕
Credential dumping via pwdumpx.exe
Attackers may use pwdumpx.exe to perform local or remote credential dumping.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003) OS Credential Dumping: Security Account Manager (T1003.002)
Indicator:
Process action type = execution AND target process name = pwdumpx.exe
Preventable: yes