Credential Access
Reading secrets out of memory and off the wire. Heavily instrumented territory: assume every handle you open to LSASS is logged.
16 techniques
T1003.001Windows08-04T1003.002Windows09-04T1003.003Windows08-04T1003.006Windows08-04T1134.001Windows08-04T1550.002Windows09-04T1550.002Windows08-04T1550.003Windows, Linux, macOS09-04T1555.004Windows08-04T1557.001Windows, Linux09-04T1558Windows09-04T1558.001Windows08-04T1558.002Windows09-04T1558.003Windows08-04T1558.004Windows08-04T1558.005Linux, macOS09-04
LSASS Memory Dump
Extract credential material from lsass.exe memory to recover plaintext passwords and hashes.
SAM Dump
Extract local account NTLM hashes from the Security Account Manager registry files for offline use.
NTDS.dit Extraction
Extract all domain credential hashes from the NTDS.dit Active Directory database offline.
DCSync Attack
Impersonate a domain controller to pull every credential hash from AD using the MS-DRSR replication protocol.
Access Token Impersonation
Steal and impersonate a privileged token from a running process to assume its identity.
Overpass the Hash
Turn an NT hash into a Kerberos TGT via the AS-REQ pre-auth, then move laterally without the password.
Pass-the-Hash
Authenticate to remote services using an NTLM hash directly, without cracking the plaintext password.
Pass the Ticket
Replay a stolen Kerberos ticket to reach a service without ever presenting the account password.
DPAPI Credential Theft
Decrypt DPAPI-protected blobs — browser passwords, RDP credentials, Wi-Fi keys — using the master key.
SMB / NTLM Relay
Redirect NTLM authentication to an attacker-controlled service and relay the challenge-response to a target.
Kerberos Delegation Abuse
Abuse constrained or unconstrained Kerberos delegation to capture or replay a user's TGT from a service.
Golden Ticket Attack
Forge a Kerberos Ticket Granting Ticket (TGT) using the krbtgt account password hash, granting persistent, domain-wide authentication that bypasses the KDC.
Silver Ticket
Forge a service ticket signed with the target service's key to reach one service without the KDC.
Kerberoasting
Request TGS tickets for service accounts and crack the RC4 or AES service key offline.
AS-REP Roasting
Request AS-REP messages for accounts with pre-authentication disabled and crack the encrypted timestamp offline.
Ccache File Theft
Steal a Kerberos credential cache file and replay its TGT or TGS without touching live process memory.
no techniques match those filters.