Hello and welcome to another
application of the MicroTech
framework discussion today
we're going to be looking at
credentialled dumping.
So our objectives for this
particular discussion are as
follows, we're going to describe
for you what credentialled dumping
is.
We're going to look at some tools as
well that can be used for that.
We'll talk about some mitigation
techniques and some detection
techniques as well.
So within minor credentialled
dumping is pretty much
as follows.
It's pretty straightforward.
So it's when a tractor attains
account login and password
information, typically the form
of hashes or clear text
is how that is going to look so
that an actor gets on a system, runs
into pulls a hash file.
That is essentially your credentials
on that system.
So some common tools associated
with financial dumping.
You may recognize some of these.
So we've got P.W.
Dump X and that's an
executable here.
And it's able to acquire hashes from
remote hosts and then it can be used
to log in systems with the hash
so you can take the hash, you steal
it, and then you execute
this particular
tool against a system
and it will use that hash to attempt
to log you in as a user.
DJ set, don't extract
password hashes from Sam Sashayed
or log log on sessions.
Memory cards, I'm sure you've heard
of before, is used to view
and save authentication credentials
like Kerberos tickets.
Now there are other attacks that
this can do in other password things
that it can it can take from the
system at Kerberos tickets is
something I've definitely seen this
to do before.
And then secret secrets
dump that Poire Python
based dump's hashes from the remote
machine without executing any agent
on the system, which could be
beneficial if you're trying to be
sneaky.
Now, all in all, password dumping
is a thing. We hear about it every
day where tons of credentials are
stolen and put on the dark
web for sale.
So what are some things that we
could do to potentially
reduce the threat actors ability to
get these credentials and steal and
what we can disable or restrict in
lemon systems?
We can ensure that local
administrator accounts have complex
and unique passwords that make
that is harder to steal and get
access to.
We can limit credential overlap
across accounts and so limiting the
reuse of passwords and ensuring
that the hash is stolen like
a local administrator account or
something of that nature, that it
can't be reused across the
organization.
Now, the detection techniques list
here, we've got two sets for Windows
and Linux based systems on Windows.
We can monitor for process
interactions with LCAC
and we can monitor for network
protocols and other replication
requests from ISPs
not associated with known domain
controllers. So things that are
trying to steal the hashes
from the active directory
systems and then on Linux
we can use the audit name and
monitor monitoring tool or
audit D, which is
by default in many Linux
distributions, and it can be used
to watch for hostile processes.
Opening this file
and the file system.
ELearning on pide
process name and arguments
of such programs that would
be used either for stealing
credentials or that would be
attempting to manipulate the system
to steal credentials.
So let's do a quick check on
learning. True or false?
Credentialled dumping is when a user
changes their password after a
compromise.
All right, well, if you need more
time, please pass the video, so
credentialled dumping is not
when a user changes their password
after a compromise, they're not
dumping that credential for anyone.
It's one the actor steals their
credentials. And so this is a false
statement.
Now, in summary of
today's discussion, we look at
credentialled dumping.
Again, that's when a third
actor either steals passwords in
plain text or in
their Hashd form.
And we looked at several tools, such
as naming cats that can be used for
that. We talked about mitigation
techniques and we reviewed
detection techniques as well
for credentialled dumping attempts.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.