domains / families / security / extracting-credentials-from-memory-dump

extracting-credentials-from-memory-dump

separate

Extracts cached credentials, password hashes, Kerberos tickets, and

When to use

• During incident response to determine what credentials an attacker had access to
• When assessing the scope of credential compromise after a breach
• For identifying accounts that need immediate password resets
• When investigating lateral movement and pass-the-hash/pass-the-ticket attacks
• For recovering encryption keys or authentication tokens from process memory

Skill page

Source