https://linuxtransfer.com/tags/credential-dumping/Recent content in Credential-Dumping on Linux SecurityHugoenMon, 02 Nov 2026 10:39:48 +0200https://linuxtransfer.com/post/2026-11-02-using-sysmon-event-id-1-patterns-to-spot-sile/Mon, 02 Nov 2026 10:39:48 +0200https://linuxtransfer.com/post/2026-11-02-using-sysmon-event-id-1-patterns-to-spot-sile/<h2 id="spotting-silent-credential-dumping-on-windows-10-workstations-with-sysmon-eventid1">Spotting Silent Credential Dumping on Windows 10 Workstations with Sysmon Event ID 1</h2> <h3 id="why-a-linuxcentric-blog-cares-about-windows-sysmon">Why a Linux‑centric blog cares about Windows Sysmon</h3> <p>Mixed‑platform environments are the norm now. A Windows 10 workstation behind the same perimeter firewall, on the same Active Directory domain, can be the entry point for a lateral attack that eventually hits your Linux servers. Detecting credential dumping early on Windows is not a luxury; it’s a practical part of a sysadmin’s defensive toolbox. Sysmon, a lightweight Microsoft Sysinternals agent, writes detailed process‑creation events to the Windows event log. Event ID 1 (“Process creation”) is the most common entry and, when filtered correctly, can expose the classic “silent” credential‑dumping techniques that slip past traditional AV.</p>