ConceptsCredential Dumping Indicators
Credential Dumping Indicators
The observable signals in logs and telemetry that credential dumping is occurring, such as suspicious access to LSASS memory, use of known dumping tools, or unusual reads of credential stores, that SIEM queries are written to catch.
7 direct links5 lessons
Concept Neighborhood
Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons
Start here
Baseline Analysis
The foundation Credential Dumping Indicators builds on, worth understanding first.
Prerequisitelearn this first
Related Lessons
5 lessons cover this conceptSIEM Data Models and Log Normalization
SOC Analyst
Aggregation and Statistical Analysis for Threat Detection
SOC Analyst
Time-Series Analysis and Multi-Source Correlation
SOC Analyst
Query Tuning, Lookup Tables, and Production Operations
SOC Analyst
Designing a Detection Program with SIEM Queries
SOC Analyst
Sign in to open lesson content directly.