Extracting Credentials From Memory Dump

---
name: extracting-credentials-from-memory-dump
description: Use when extract cached credentials, password hashes, Kerberos tickets,
  and authentication tokens from memory dumps using Volatility and Mimikatz for forensic
  investigation. Use when working with extracting credentials from memory dump.
domain: cybersecurity
tags:
- forensics
- credential-extraction
- memory-forensics
- volatility
- mimikatz
- password-hashes
- incident-response
subdomain: digital-forensics
mitre_attack:
- T1003
- T1558
- T1552
version: '1.0'
author: oyi77
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
category: cybersecurity
---

# Extracting Credentials From Memory Dump

## Overview

Cybersecurity skill for extracting credentials from memory dump. Follows industry best practices and security standards.

## When to Use
**Trigger phrases:**
- "extracting credentials from memory dump"
- "Extract cached credentials, password hashes, Kerberos tickets, and authenticatio"

- During incident response to determine what credentials an attacker had access to
- When assessing the scope of credential compromise after a breach
- For identifying accounts that need immediate password resets
- When investigating lateral movement and pass-the-hash/pass-the-ticket attacks
- For recovering encryption keys or authentication tokens from process memory


## When NOT to Use

- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope


## Prerequisites
- Memory dump in raw, ELF, or crash dump format
- Volatility 3 with Windows symbol tables
- Mimikatz (for offline analysis of extracted LSASS dumps)
- pypykatz (Python implementation of Mimikatz for Linux-based analysis)
- Understanding of Windows authentication (NTLM, Kerberos, DPAPI)
- Appropriate legal authorization for credential extraction

## Workflow

```python
# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}
```

1. **Define Objectives** — Clarify the goals and scope for credentials from memory dump.
2. **Gather Resources** — Collect tools, data, and access needed for credentials from memory dump.
3. **Execute Process** — Carry out credentials from memory dump operations methodically.
4. **Verify Quality** — Check results against acceptance criteria.
5. **Document Outcomes** — Record findings, decisions, and next steps.

## Tools

- **Analysis Platform** — Data processing and visualization
- **Collaboration Tools** — Team coordination and knowledge sharing


## Process

1. **Prepare** — Gather requirements, verify prerequisites, set up environment
1. **Execute** — Run extracting credentials from memory dump workflow with configured parameters
1. **Verify** — Validate output meets requirements, document results

## Verification

- [ ] All credentials from memory dump procedures executed completely and documented
- [ ] Findings validated against multiple data sources
- [ ] False positives identified and filtered
- [ ] Results documented with evidence and timestamps
- [ ] Recommendations provided with risk-based prioritization

## Anti-Rationalization Table

| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |