Credential Access & Dumping

Dumping Credentials from Lsass Process Memory with Mimikatz

Dumping Lsass Without Mimikatz

Dumping Lsass without Mimikatz with MiniDumpWriteDump

Dumping Hashes from SAM via Registry

Dumping SAM via esentutl.exe

Dumping LSA Secrets

Dumping and Cracking mscash - Cached Domain Credentials

Dumping Domain Controller Hashes Locally and Remotely

Dumping Domain Controller Hashes via wmic and Vssadmin Shadow Copy

Network vs Interactive Logons

Reading DPAPI Encrypted Secrets with Mimikatz and C++

Credentials in Registry

Password Filter

Forcing WDigest to Store Credentials in Plaintext

Dumping Delegated Default Kerberos and NTLM Credentials w/o Touching Lsass

Intercepting Logon Credentials via Custom Security Support Provider and Authentication Packages

Pulling Web Application Passwords by Hooking HTML Input Fields

Intercepting Logon Credentials by Hooking msv1_0!SpAcceptCredentials

Credentials Collection via CredUIPromptForCredentials