skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

11|1|Updated May 4, 2026
Search Tags:#incident response#threat hunting#MITRE ATT&CK#memory forensics#credential theft#LSASS analysis#Windows forensics
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill credential-theft-hunt
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: credential-theft-hunt
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/memory-forensics/skills/credential-theft-hunt
Command: npx skills add https://github.com/dreadnode/capabilities --skill credential-theft-hunt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the critical incident response challenge of identifying and recovering credentials stolen via OS credential dumping during security breaches, eliminating time-consuming, error-prone manual analysis of Windows memory images for credential theft evidence.

Core Features & Use Cases

  • MITRE ATT&CK T1003 Mapping: Aligns findings to all OS Credential Dumping sub-techniques (T1003.001 through T1003.006) for standardized reporting.
  • Comprehensive Credential Extraction: Recovers SAM hashes, LSA secrets, cached domain credentials, Kerberos tickets, and LSASS memory credentials from Windows memory dumps.
  • Credential Theft Tooling Detection: Identifies artifacts of Mimikatz, Dumpert, NanoDump, and living-off-the-land LSASS dumping techniques via process analysis and YARA scanning.
  • Use Case: Incident response teams can use this Skill to quickly determine if an attacker harvested credentials from a compromised endpoint, and generate a seed set of affected accounts for mandatory password resets.

Quick Start

Use the credential-theft-hunt skill to analyze the provided Windows memory image, recover all accessible credentials, and identify any evidence of credential theft activity.

Frequently Asked Questions about credential-theft-hunt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect credential theft artifacts in Windows memory images?▼

Detect credential theft artifacts in Windows memory images by leveraging Volatility 3 plugins and YARA scanning to extract SAM hashes, LSA secrets, cached domain credentials, and identify LSASS dumping tradecraft for incident response scoping.

Can I extract Kerberos tickets and SAM hashes from a memory dump for incident response?▼

Extract Kerberos tickets and SAM hashes from a memory dump by performing offline analysis of dumped LSASS memory and applying Volatility 3 plugins to recover cached domain credentials during incident response operations.

Does this credential theft detection method map to MITRE ATT&CK T1003 sub-techniques?▼

This credential theft detection method maps directly to MITRE ATT&CK T1003, covering all OS Credential Dumping sub-techniques (T1003.001 through T1003.006) to provide standardized reporting for threat hunting and incident response.

How do I identify Mimikatz and NanoDump artifacts during LSASS analysis?▼

Identify Mimikatz and NanoDump artifacts during LSASS analysis by running YARA scans across the Windows memory image to detect known credential theft tooling signatures and analyzing processes for living-off-the-land dumping techniques.

What is the best way to generate a seed set of compromised accounts for password resets?▼

Generate a seed set of compromised accounts for password resets by recovering all accessible credentials from the Windows memory image and validating lateral movement artifacts to identify affected users requiring mandatory credential resets.

Do I need Volatility 3 to perform memory forensics for LSASS dumping artifacts?▼

Memory forensics for LSASS dumping artifacts leverages Volatility 3 plugins to parse Windows memory images, alongside YARA scanning for known credential theft tooling, to extract LSA secrets and cached domain credentials during incident response.

Related Skills

Explore More Data & Analytics Skills→
wshobsonwshobson
38.6k

memory-forensics

Acquire and analyze memory dumps with Volatility 3.

Community
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
infantesromeroadrianinfantesromeroadrian

pentest-forensics-analyst

Guide digital forensics and incident response with evidence acquisition, analysis, and reporting.

Community
Advanced
YukiIto1999YukiIto1999

extracting-credentials-from-memory-dump

Extract credentials from memory dumps using Volatility 3 and pypykatz.

Community
Intermediate