extracting-credentials-from-memory-dump

What problem does it solve? During incident response and breach investigations, analysts need to determine which credentials were exposed in a compromised system's memory. This Skill provides a structured workflow for extracting NTLM hashes, Kerberos tickets, plaintext passwords, DPAPI keys, and cloud tokens from memory dumps so teams can scope credential compromise and prioritize resets. ## Core Features & Use Cases - Hash and Secret Extraction: Dump SAM database hashes, LSA secrets, and cached domain credentials using Volatility 3 plugins (hashdump, lsadump, cachedump). - LSASS Analysis: Dump LSASS process memory and parse it with pypykatz or Mimikatz to recover NTLM hashes, Kerberos TGTs/TGS tickets, WDigest plaintext passwords, and DPAPI master keys. - Token and Cloud Credential Discovery: Search process memory strings for AWS access keys, Azure tokens, API keys, and browser session identifiers. - Use Case: After a ransomware incident, an analyst runs this workflow against a pre-encryption memory dump to discover that a domain admin Kerberos TGT and the krbtgt hash were exposed, triggering an immediate double krbtgt reset and enterprise-wide password rotation. ## Quick Start Analyze the memory dump at /cases/case-2024-001/memory/memory.raw to extract all cached credentials and Kerberos tickets, then produce a credential compromise report listing affected accounts and recommended reset actions.