Tool: gsecdump

Description

[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)

External References

• mitre-attack
• TrueSec Gsecdump

Techniques Used by This Tool

• T1003.002 — Security Account Manager
• T1003.004 — LSA Secrets

APT Groups Using This Tool

• BRONZE BUTLER
• Threat Group-3390
• Tonto Team
• APT1
• PittyTiger