Command Line
TTTracer.exe -dumpFull -attach pid
Description
Use tttracer.exe to perform a memory dump for a given Process ID
Risk
High
Risk Reason
Use of tttracer should only be expected in development, IT or research operations, if that.
Fidelity
High
Fidelity Reason
Monitor for anomalous process dumping usage.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1003
Description: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.
Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Tactics: