author: Patrick Bareiss, Splunk
date: '2020-07-16'
description: This response workflow guide you through the investigation of a credential
  dumping attack.
id: 570dd98e-6cab-443c-bdd8-3dbb5fe4188d
name: Credential Dumping Attack
response_phase:
- identification:
  - id: c5506139-ef86-4cd9-8535-0512aa732e79
    name: Process Chain Analysis
  - id: 6ee5c067-8228-4926-abb2-54f2c59d726e
    name: Analyze Malicious File
  - id: 1d7b437a-5114-4b94-a585-04c3362ba08f
    name: Malware Hunt and Contain
- containment:
  - id: 60c4cfa5-81b7-44e2-9ad4-71524e4a3e78
    name: Quarantaine Infected Host
tags:
  analytics_story: Credential Dumping
  product:
  - Splunk Phantom
type: response
version: 2
workflow: This workbook provides you a guide on how to investigate credential dumping
  with some automation to make data collection easier.
