Windows Dump Credential Manager using keymgr.dll and rundll32.exe (T1003)

Danny Y@zendannyy

•updated Jun 20, 2026•0•0•1

Hunting rule for "Dump Credential Manager using keymgr.dll and rundll32.exe" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.