Credential Access & Dumping

Here are the articles in this section:
Dumping Credentials from Lsass.exe Process Memory
Local Security Authority (LSA) credential dumping with in-memory Mimikatz using powershell.
Dumping Lsass.exe to Disk Without Mimikatz and Extracting Credentials
Dumping LSASS without Mimikatz with MiniDumpWriteDump == Reduced Chances of Getting Flagged by AVs
Evasion, Credential Dumping
Dumping Hashes from SAM via Registry
Security Accounts Manager (SAM) credential dumping with living off the land binary.
Dumping SAM via esentutl.exe
Dumping LSA Secrets
Dumping and Cracking mscash - Cached Domain Credentials
Dumping Domain Controller Hashes Locally and Remotely
Dumping NTDS.dit with Active Directory users hashes
Dumping Domain Controller Hashes via wmic and Vssadmin Shadow Copy
Network vs Interactive Logons
This lab explores/compares when credentials are susceptible to credential dumping.
Reading DPAPI Encrypted Secrets with Mimikatz and C++
T1214: Credentials in Registry
Internal recon, hunting for passwords in Windows registry
T1174: Password Filter
Credential Access
Forcing WDigest to Store Credentials in Plaintext
Dumping Delegated Default Kerberos and NTLM Credentials w/o Touching LSASS
Intercepting Logon Credentials via Custom Security Support Provider and Authentication Packages
Credential Access, Persistence
Pulling Web Application Passwords by Hooking HTML Input Fields
Credential Access, Keylogger
Intercepting Logon Credentials by Hooking msv1_0!SpAcceptCredentials
Hooking, Credential Stealing
Credentials Collection via CredUIPromptForCredentials