{
  "technique_id": "T1003",
  "name": "OS Credential Dumping",
  "tactics": [
    "Credential Access"
  ],
  "platforms": [
    "Windows",
    "Linux",
    "macOS"
  ],
  "summary": "Adversaries may dump credentials from operating system memory or storage (LSASS, SAM, NTDS.dit, /etc/shadow, keychains) to obtain account credentials for further access and lateral movement.\n",
  "generated_by": "SOC Response Atlas by Basyrix"
}