CCFH-202B: CrowdStrike Certified Falcon Hunter

Question

During an investigation, you observe that an adversary is attempting to Gain Access through Credential Access via OS Credential Dumping.

According to the MITRE ATT&CK Framework, which attacker technique can also be used as a filter on the detections page to locate similar activity?

Explanation

MITRE ATT&CK classifies Credential Access as a tactic and OS Credential Dumping as the technique (T1003). A technique-based detections filter therefore uses OS Credential Dumping to find related activity.

Learn more

OS Credential Dumping, Technique T1003 - MITRE ATT&CK

CCFH-202B: CrowdStrike Certified Falcon Hunter

AstroTutor

Notes

Readiness

QuestionQ83

Community Discussion