{
  "node_id": "mitre-atlas-os-credential-dumping",
  "title": "MITRE ATLAS OS Credential Dumping (AML.T0090) - Adversarial use of OS Credential Dumping as adapted in MITRE ATT&CK T1003",
  "domain": "AI Governance & Law",
  "version": "1.0.1",
  "last_updated": "2026-07-22",
  "bluf": "This node addresses MITRE ATLAS technique AML.T0090 (OS Credential Dumping). Adversaries may extract credentials from OS caches, application memory, or other sources on a compromised system. Credentials are often in the form of a hash or clear text, and can include usernames and passwords, application tokens, or other authentication keys. Credentials can be used to perform Lateral Movement to access other AI services such as AI agents, LLMs, or AI inference APIs. Credentials could also give an adversary access to other software tools and data sources that are part of the AI DevOps lifecycle. Defending against this technique is required under EU AI Act, NIST AI RMF, and ISO/IEC 42001 obligations; this node operationalises the documented ATLAS mitigations and cross-instrument controls into a deterministic verification workflow. ATT&CK reference: T1003 provides authoritative mitigation guidance for this technique class.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-ai-rmf-1-0",
    "eu-ai-act-2024",
    "iso-iec-42001-ai-management-system-2023"
  ],
  "primary_citations_count": 6
}