extracting-credentials-from-memory-dump

name	extracting-credentials-from-memory-dump
description	Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation. Use when working with extracting credentials from memory dump.
domain	cybersecurity
tags	["forensics","credential-extraction","memory-forensics","volatility","mimikatz","password-hashes","incident-response"]
subdomain	digital-forensics
mitre_attack	["T1003","T1558","T1552"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Extracting Credentials From Memory Dump

Overview

Cybersecurity skill for extracting credentials from memory dump. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "extracting credentials from memory dump"

• "Extract cached credentials, password hashes, Kerberos tickets, and authenticatio"

• During incident response to determine what credentials an attacker had access to

• When assessing the scope of credential compromise after a breach

• For identifying accounts that need immediate password resets

• When investigating lateral movement and pass-the-hash/pass-the-ticket attacks

• For recovering encryption keys or authentication tokens from process memory

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Memory dump in raw, ELF, or crash dump format
• Volatility 3 with Windows symbol tables
• Mimikatz (for offline analysis of extracted LSASS dumps)
• pypykatz (Python implementation of Mimikatz for Linux-based analysis)
• Understanding of Windows authentication (NTLM, Kerberos, DPAPI)
• Appropriate legal authorization for credential extraction

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}