extracting-credentials-from-memory-dump

Extract credentials, hashes, and Kerberos tickets from Windows memory dumps using Volatility and pypykatz.

Updated May 27, 2026

Search Tags:#incident response #volatility #mimikatz #kerberos #memory forensics #credential extraction #pypykatz

Ready to run

npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill extracting-credentials-from-memory-dump-baljinnyamday

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: extracting-credentials-from-memory-dump
Source: https://github.com/baljinnyamday/autonomous-red-team-agent/tree/main/harness/src/agent_redteam/skill_library/extracting-credentials-from-memory-dump
Command: npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill extracting-credentials-from-memory-dump-baljinnyamday

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires volatility3, pypykatz.

What problem does it solve? During incident response and breach investigations, analysts need to determine which credentials were exposed in a compromised system's memory. This Skill provides a structured workflow for extracting NTLM hashes, Kerberos tickets, plaintext passwords, DPAPI keys, and cloud tokens from memory dumps so teams can scope credential compromise and prioritize resets. ## Core Features & Use Cases - Hash and Secret Extraction: Dump SAM database hashes, LSA secrets, and cached domain credentials using Volatility 3 plugins (hashdump, lsadump, cachedump). - LSASS Analysis: Dump LSASS process memory and parse it with pypykatz or Mimikatz to recover NTLM hashes, Kerberos TGTs/TGS tickets, WDigest plaintext passwords, and DPAPI master keys. - Token and Cloud Credential Discovery: Search process memory strings for AWS access keys, Azure tokens, API keys, and browser session identifiers. - Use Case: After a ransomware incident, an analyst runs this workflow against a pre-encryption memory dump to discover that a domain admin Kerberos TGT and the krbtgt hash were exposed, triggering an immediate double krbtgt reset and enterprise-wide password rotation. ## Quick Start Analyze the memory dump at /cases/case-2024-001/memory/memory.raw to extract all cached credentials and Kerberos tickets, then produce a credential compromise report listing affected accounts and recommended reset actions.

Frequently Asked Questions about extracting-credentials-from-memory-dump

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract credentials from a memory dump?▼

Use Volatility 3 to identify the LSASS process and dump its memory, then parse the dump with pypykatz or Mimikatz to recover NTLM hashes, Kerberos tickets, and plaintext passwords. Volatility's hashdump, lsadump, and cachedump plugins extract SAM hashes and LSA secrets directly from the full image.

What tools are used for LSASS memory analysis?▼

Volatility 3 handles memory parsing and process dumping, while pypykatz (a Python Mimikatz implementation) parses LSASS dumps cross-platform. Mimikatz itself can be used offline against extracted dumps, and Impacket's secretsdump.py works on SAM/SYSTEM/SECURITY hives.

Can pypykatz analyze memory dumps on Linux?▼

Yes, pypykatz is a pure Python implementation of Mimikatz that runs on Linux and can parse LSASS minidumps or full raw memory images. It supports JSON output and can export Kerberos tickets as .kirbi files for further analysis.

What memory dump formats does Volatility 3 support?▼

Volatility 3 supports raw memory images, ELF core dumps, and Windows crash dump formats. You must first identify the OS version with the windows.info plugin and ensure the appropriate Windows symbol tables are available before running credential plugins.

Why does credential extraction fail on newer Windows versions?▼

Windows 8.1 and later disable WDigest plaintext password storage by default, and Credential Guard on newer builds isolates LSASS secrets in a virtualized container. In these cases you may only recover NTLM hashes and Kerberos tickets rather than plaintext passwords.