[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71B26XH75FF9TKMKEP6JBWB":3,"skill-same:01M71B26XH75FF9TKMKEP6JBWB":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":67},"01M71B26XH75FF9TKMKEP6JBWB","cyber-extracting-credentials-from-memory-dump",null,"Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-extracting-credentials-from-memory-dump\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"memory","credentials","dump","cyber extracting credentials from memory dump","extracting credentials from memory dump","extracting","memory-forensics","tokens","for","mimikatz","domain","t1003","digital-forensics","t1074","subdomain","false","cybersecurity","authentication","incident","Volatility","2026-11-10 10:12:30",false,"---\nname: cyber-extracting-credentials-from-memory-dump\ndescription: \"Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: extracting-credentials-from-memory-dump | description: Extract cached credentials, password hashes, Kerberos tickets, and authentication |   tokens from memory dumps using Volatility and Mimikatz for forensic investigation. | domain: cybersecurity | subdomain: digital-forensics | tags: | - forensics | - credential-extraction | - memory-forensics | - volatility | - mimikatz | - password-hashes | - incident-response | mitre_attack: | - T1005 | - T1074 | - T1119 | - T1070 | - T1003 | mitre_f3\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Extracting Credentials from Memory Dump\n\n## When to Use\n- During incident response to determine what credentials an attacker had access to\n- When assessing the scope of credential compromise after a breach\n- For identifying accounts that need immediate password resets\n- When investigating lateral movement and pass-the-hash\u002Fpass-the-ticket attacks\n- For recovering encryption keys or authentication tokens from process memory\n\n## Prerequisites\n- Memory dump in raw, ELF, or crash dump format\n- Volatility 3 with Windows symbol tables\n- Mimikatz (for offline analysis of extracted LSASS dumps)\n- pypykatz (Python implementation of Mimikatz for Linux-based analysis)\n- Understanding of Windows authentication (NTLM, Kerberos, DPAPI)\n- Appropriate legal authorization for credential extraction\n\n## Workflow\n\n### Step 1: Prepare Tools and Verify Memory Dump\n\n```bash\n# Install analysis tools\npip install volatility3 pypykatz\n\n# Verify memory dump integrity\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw\n\n# Identify the OS version\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.info\n\n# Verify LSASS process exists in memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.pslist | grep -i lsass\n\n# Output:\n# PID    PPID   ImageFileName   Offset(V)        Threads  Handles  SessionId\n# 684    564    lsass.exe       0xffffe00123456   35       1234     0\n```\n\n### Step 2: Extract Credential Hashes with Volatility\n\n```bash\n# Dump SAM database hashes from memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.hashdump \\\n   | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhashdump.txt\n\n# Output format:\n# User           RID    LM Hash                          NTLM Hash\n# Administrator  500    aad3b435b51404eeaad3b435b51404ee  fc525c9683e8fe067095ba2ddc971889\n# Guest          501    aad3b435b51404eeaad3b435b51404ee  31d6cfe0d16ae931b73c59d7e0c089c0\n# DefaultAccount 503    aad3b435b51404eeaad3b435b51404ee  31d6cfe0d16ae931b73c59d7e0c089c0\n# svcbackup      1001   aad3b435b51404eeaad3b435b51404ee  2b576acbe6bcfda7294d6bd18041b8fe\n\n# Extract LSA secrets\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.lsadump \\\n   | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsadump.txt\n\n# Extract cached domain credentials\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.cachedump \\\n   | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcachedump.txt\n```\n\n### Step 3: Dump LSASS Process Memory for Detailed Analysis\n\n```bash\n# Dump LSASS process memory (PID from Step 1)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.memmap --pid 684 --dump \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass_dump\u002F\n\n# Alternative: Dump all files associated with LSASS\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.dumpfiles --pid 684 \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass_files\u002F\n\n# Use procdump plugin for cleaner process dump\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.dumpfiles \\\n   --pid 684 -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F\n\n# Rename the dump file for pypykatz\u002Fmimikatz\nmv \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass_dump\u002Fpid.684.dmp \\\n   \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass.dmp\n```\n\n### Step 4: Extract Credentials with pypykatz\n\n```bash\n# Run pypykatz against the full memory dump\npypykatz lsa minidump \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass.dmp \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpypykatz_results.txt 2>&1\n\n# Run pypykatz against the raw memory dump directly\npypykatz rekall \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpypykatz_full.txt 2>&1\n\n# Parse pypykatz output for structured analysis\npython3 \u003C\u003C 'PYEOF'\nimport json\n\n# pypykatz can also output JSON\nimport subprocess\nresult = subprocess.run(\n    ['pypykatz', 'lsa', 'minidump', '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass.dmp', '-j'],\n    capture_output=True, text=True\n)\n\nif result.stdout:\n    data = json.loads(result.stdout)\n\n    print(\"=== EXTRACTED CREDENTIALS ===\\n\")\n\n    for session_key, session in data.get('logon_sessions', {}).items():\n        username = session.get('username', 'Unknown')\n        domain = session.get('domainname', '')\n        logon_server = session.get('logon_server', '')\n        logon_time = session.get('logon_time', '')\n        sid = session.get('sid', '')\n\n        if username and username != '(null)':\n            print(f\"Session: {domain}\\\\{username}\")\n            print(f\"  SID: {sid}\")\n            print(f\"  Logon Server: {logon_server}\")\n            print(f\"  Logon Time: {logon_time}\")\n\n            # NTLM hashes\n            msv = session.get('msv_creds', [])\n            for cred in msv:\n                nt = cred.get('NThash', '')\n                lm = cred.get('LMHash', '')\n                if nt:\n                    print(f\"  NTLM Hash: {nt}\")\n                if lm:\n                    print(f\"  LM Hash: {lm}\")\n\n            # Kerberos tickets\n            kerb = session.get('kerberos_creds', [])\n            for cred in kerb:\n                password = cred.get('password', '')\n                if password:\n                    print(f\"  Kerberos Password: {password}\")\n                tickets = cred.get('tickets', [])\n                for ticket in tickets:\n                    print(f\"  Kerberos Ticket: {ticket.get('server', '')} (type: {ticket.get('enc_type', '')})\")\n\n            # WDigest (plaintext on older systems)\n            wdigest = session.get('wdigest_creds', [])\n            for cred in wdigest:\n                pwd = cred.get('password', '')\n                if pwd:\n                    print(f\"  WDigest Password: {pwd}\")\n\n            # DPAPI master keys\n            dpapi = session.get('dpapi_creds', [])\n            for cred in dpapi:\n                mk = cred.get('masterkey', '')\n                if mk:\n                    print(f\"  DPAPI Master Key: {mk[:40]}...\")\n\n            print()\nPYEOF\n```\n\n### Step 5: Extract Kerberos Tickets and Tokens\n\n```bash\n# Extract Kerberos tickets from memory\npython3 \u003C\u003C 'PYEOF'\nimport subprocess, json\n\nresult = subprocess.run(\n    ['pypykatz', 'lsa', 'minidump', '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass.dmp', '-j', '-k', '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fkerberos\u002F'],\n    capture_output=True, text=True\n)\n\n# pypykatz exports .kirbi files to the specified directory\nimport os\nkirbi_dir = '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fkerberos\u002F'\nif os.path.exists(kirbi_dir):\n    for f in os.listdir(kirbi_dir):\n        if f.endswith('.kirbi'):\n            filepath = os.path.join(kirbi_dir, f)\n            size = os.path.getsize(filepath)\n            print(f\"  Kerberos ticket: {f} ({size} bytes)\")\nPYEOF\n\n# Search process memory for authentication tokens and API keys\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.strings --pid 684 | \\\n   grep -iE '(bearer |authorization:|api[_-]key|token=|password=|secret=)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fauth_strings.txt\n\n# Search for cloud credentials in memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.strings | \\\n   grep -iE '(AKIA[A-Z0-9]{16}|ASIA[A-Z0-9]{16}|aws_secret_access_key)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faws_credentials.txt\n\n# Search for browser session tokens\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.strings | \\\n   grep -iE '(session_id=|PHPSESSID=|JSESSIONID=|_ga=|sid=)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsession_tokens.txt\n```\n\n### Step 6: Compile Credential Findings Report\n\n```bash\n# Generate credential compromise assessment\npython3 \u003C\u003C 'PYEOF'\nprint(\"\"\"\nCREDENTIAL EXTRACTION REPORT\n==============================\nCase: 2024-001\nSource: memory.raw (16 GB Windows 10 memory dump)\nAnalysis Date: 2024-01-20\n\nCOMPROMISED ACCOUNTS:\n=====================\n\n1. Local Accounts (SAM):\n   - Administrator (RID 500): NTLM hash extracted\n   - svcbackup (RID 1001): NTLM hash extracted\n   - SQLService (RID 1002): NTLM hash extracted\n\n2. Domain Accounts (LSASS):\n   - CORP\\\\admin.user: NTLM hash + Kerberos TGT\n   - CORP\\\\svc.backup: NTLM hash + plaintext password (WDigest)\n   - CORP\\\\domain.admin: Kerberos TGS tickets for 3 services\n\n3. Cached Domain Credentials:\n   - CORP\\\\helpdesk.user: DCC2 hash\n   - CORP\\\\it.manager: DCC2 hash\n\n4. Cloud Credentials:\n   - AWS Access Key: AKIA... found in process memory (PID 3456)\n   - Azure AD token found in browser process memory\n\nIMMEDIATE ACTIONS REQUIRED:\n- Reset passwords for all listed accounts\n- Revoke and rotate AWS access keys\n- Invalidate all active Kerberos tickets (krbtgt reset)\n- Review DPAPI-protected data for additional exposure\n\"\"\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LSASS (Local Security Authority) | Windows process managing authentication, storing credentials in memory |\n| NTLM hash | NT LAN Manager hash of user password used for authentication |\n| Kerberos TGT | Ticket Granting Ticket allowing request of service tickets |\n| WDigest | Legacy authentication protocol storing plaintext passwords in memory (pre-Win8.1) |\n| DPAPI | Data Protection API using master keys derived from user credentials |\n| DCC2 (Domain Cached Credentials) | Cached domain password hashes for offline logon |\n| LSA Secrets | Encrypted service account passwords and other secrets stored by LSA |\n| Pass-the-Hash | Attack technique using extracted NTLM hashes without knowing the plaintext password |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Volatility 3 | Memory forensics framework with hashdump, lsadump, cachedump plugins |\n| pypykatz | Python implementation of Mimikatz for cross-platform LSASS analysis |\n| Mimikatz | Windows credential extraction tool (used offline against dumps) |\n| secretsdump.py | Impacket tool for extracting secrets from SAM\u002FSYSTEM\u002FSECURITY |\n| hashcat | Password hash cracking for recovered NTLM and DCC2 hashes |\n| John the Ripper | Alternative password cracking tool |\n| Rubeus | Kerberos ticket manipulation and extraction tool |\n| Impacket | Python toolkit for working with Windows network protocols and credentials |\n\n## Common Scenarios\n\n**Scenario 1: Post-Breach Credential Assessment**\nExtract all cached credentials from LSASS memory to determine which accounts were exposed, prioritize password resets based on privilege level, check for golden ticket material (krbtgt hash), assess if cloud credentials were accessible.\n\n**Scenario 2: Lateral Movement Investigation**\nExtract NTLM hashes and Kerberos tickets to understand how the attacker moved between systems, identify pass-the-hash\u002Fpass-the-ticket artifacts, correlate extracted credentials with network logon events in event logs.\n\n**Scenario 3: Ransomware Operator Credential Theft**\nAnalyze pre-encryption memory dump for Mimikatz execution evidence, extract all available credential types, determine if domain admin credentials were obtained, assess if krbtgt was compromised (golden ticket), plan credential rotation strategy.\n\n**Scenario 4: Cloud Credential Theft from Endpoint**\nSearch endpoint memory for AWS access keys, Azure tokens, and GCP service account keys stored by CLI tools and browsers, identify exposed cloud permissions, immediately rotate discovered credentials, audit cloud audit logs for unauthorized access.\n\n## Output Format\n\n```\nCredential Extraction Summary:\n  Source: memory.raw (16 GB, Windows 10 Build 19041)\n  LSASS PID: 684\n\n  Credentials Recovered:\n    Local NTLM Hashes:        4 accounts\n    Domain NTLM Hashes:       3 accounts\n    Kerberos TGTs:             2 tickets\n    Kerberos TGS:              5 service tickets\n    Plaintext Passwords:       1 (WDigest - svc.backup)\n    Cached Domain Creds:       2 DCC2 hashes\n    LSA Secrets:               3 service account passwords\n    DPAPI Master Keys:         4 keys recovered\n    Cloud Credentials:         1 AWS access key, 1 Azure token\n\n  Highest Privilege Compromised: Domain Admin (CORP\\domain.admin)\n\n  Recommended Actions:\n    - Immediate: Reset all extracted account passwords\n    - Immediate: Rotate AWS access key AKIA...\n    - Urgent: Double krbtgt password reset (golden ticket mitigation)\n    - High: Revoke all Kerberos tickets via krbtgt rotation\n    - Medium: Audit DPAPI-protected data exposure\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Extracting Credentials from Memory Dump\n\n## When to Use\n- During incident response to determine what credentials an attacker had access to\n- When assessing the scope of credential compromise after a breach\n- For identifying accounts that need immediate password resets\n- When investigating lateral movement and pass-the-hash\u002Fpass-the-ticket attacks\n- For recovering encryption keys or authentication tokens from process memory\n\n## Prerequisites\n- Memory dump in raw, ELF, or crash dump format\n- Volatility 3 with Windows symbol tables\n- Mimikatz (for offline analysis of extracted LSASS dumps)\n- pypykatz (Python implementation of Mimikatz for Linux-based analysis)\n- Understanding of Windows authentication (NTLM, Kerberos, DPAPI)\n- Appropriate legal authorization for credential extraction\n\n## Workflow\n\n### Step 1: Prepare Tools and Verify Memory Dump\n\n```bash\n# Install analysis tools\npip install volatility3 pypykatz\n\n# Verify memory dump integrity\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw\n\n# Identify the OS version\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.info\n\n# Verify LSASS process exists in memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.pslist | grep -i lsass\n\n# Output:\n# PID    PPID   ImageFileName   Offset(V)        Threads  Handles  SessionId\n# 684    564    lsass.exe       0xffffe00123456   35       1234     0\n```\n\n### Step 2: Extract Credential Hashes with Volatility\n\n```bash\n# Dump SAM database hashes from memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.hashdump \\\n   | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhashdump.txt\n\n# Output format:\n# User           RID    LM Hash                          NTLM Hash\n# Administrator  500    aad3b435b51404eeaad3b435b51404ee  fc525c9683e8fe067095ba2ddc971889\n# Guest          501    aad3b435b51404eeaad3b435b51404ee  31d6cfe0d16ae931b73c59d7e0c089c0\n# DefaultAccount 503    aad3b435b51404eeaad3b435b51404ee  31d6cfe0d16ae931b73c59d7e0c089c0\n# svcbackup      1001   aad3b435b51404eeaad3b435b51404ee  2b576acbe6bcfda7294d6bd18041b8fe\n\n# Extract LSA secrets\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.lsadump \\\n   | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsadump.txt\n\n# Extract cached domain credentials\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.cachedump \\\n   | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcachedump.txt\n```\n\n### Step 3: Dump LSASS Process Memory for Detailed Analysis\n\n```bash\n# Dump LSASS process memory (PID from Step 1)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.memmap --pid 684 --dump \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass_dump\u002F\n\n# Alternative: Dump all files associated with LSASS\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.dumpfiles --pid 684 \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass_files\u002F\n\n# Use procdump plugin for cleaner process dump\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.dumpfiles \\\n   --pid 684 -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F\n\n# Rename the dump file for pypykatz\u002Fmimikatz\nmv \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass_dump\u002Fpid.684.dmp \\\n   \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass.dmp\n```\n\n### Step 4: Extract Credentials with pypykatz\n\n```bash\n# Run pypykatz against the full memory dump\npypykatz lsa minidump \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass.dmp \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpypykatz_results.txt 2>&1\n\n# Run pypykatz against the raw memory dump directly\npypykatz rekall \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpypykatz_full.txt 2>&1\n\n# Parse pypykatz output for structured analysis\npython3 \u003C\u003C 'PYEOF'\nimport json\n\n# pypykatz can also output JSON\nimport subprocess\nresult = subprocess.run(\n    ['pypykatz', 'lsa', 'minidump', '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass.dmp', '-j'],\n    capture_output=True, text=True\n)\n\nif result.stdout:\n    data = json.loads(result.stdout)\n\n    print(\"=== EXTRACTED CREDENTIALS ===\\n\")\n\n    for session_key, session in data.get('logon_sessions', {}).items():\n        username = session.get('username', 'Unknown')\n        domain = session.get('domainname', '')\n        logon_server = session.get('logon_server', '')\n        logon_time = session.get('logon_time', '')\n        sid = session.get('sid', '')\n\n        if username and username != '(null)':\n            print(f\"Session: {domain}\\\\{username}\")\n            print(f\"  SID: {sid}\")\n            print(f\"  Logon Server: {logon_server}\")\n            print(f\"  Logon Time: {logon_time}\")\n\n            # NTLM hashes\n            msv = session.get('msv_creds', [])\n            for cred in msv:\n                nt = cred.get('NThash', '')\n                lm = cred.get('LMHash', '')\n                if nt:\n                    print(f\"  NTLM Hash: {nt}\")\n                if lm:\n                    print(f\"  LM Hash: {lm}\")\n\n            # Kerberos tickets\n            kerb = session.get('kerberos_creds', [])\n            for cred in kerb:\n                password = cred.get('password', '')\n                if password:\n                    print(f\"  Kerberos Password: {password}\")\n                tickets = cred.get('tickets', [])\n                for ticket in tickets:\n                    print(f\"  Kerberos Ticket: {ticket.get('server', '')} (type: {ticket.get('enc_type', '')})\")\n\n            # WDigest (plaintext on older systems)\n            wdigest = session.get('wdigest_creds', [])\n            for cred in wdigest:\n                pwd = cred.get('password', '')\n                if pwd:\n                    print(f\"  WDigest Password: {pwd}\")\n\n            # DPAPI master keys\n            dpapi = session.get('dpapi_creds', [])\n            for cred in dpapi:\n                mk = cred.get('masterkey', '')\n                if mk:\n                    print(f\"  DPAPI Master Key: {mk[:40]}...\")\n\n            print()\nPYEOF\n```\n\n### Step 5: Extract Kerberos Tickets and Tokens\n\n```bash\n# Extract Kerberos tickets from memory\npython3 \u003C\u003C 'PYEOF'\nimport subprocess, json\n\nresult = subprocess.run(\n    ['pypykatz', 'lsa', 'minidump', '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsass.dmp', '-j', '-k', '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fkerberos\u002F'],\n    capture_output=True, text=True\n)\n\n# pypykatz exports .kirbi files to the specified directory\nimport os\nkirbi_dir = '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fkerberos\u002F'\nif os.path.exists(kirbi_dir):\n    for f in os.listdir(kirbi_dir):\n        if f.endswith('.kirbi'):\n            filepath = os.path.join(kirbi_dir, f)\n            size = os.path.getsize(filepath)\n            print(f\"  Kerberos ticket: {f} ({size} bytes)\")\nPYEOF\n\n# Search process memory for authentication tokens and API keys\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.strings --pid 684 | \\\n   grep -iE '(bearer |authorization:|api[_-]key|token=|password=|secret=)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fauth_strings.txt\n\n# Search for cloud credentials in memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.strings | \\\n   grep -iE '(AKIA[A-Z0-9]{16}|ASIA[A-Z0-9]{16}|aws_secret_access_key)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faws_credentials.txt\n\n# Search for browser session tokens\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.strings | \\\n   grep -iE '(session_id=|PHPSESSID=|JSESSIONID=|_ga=|sid=)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsession_tokens.txt\n```\n\n### Step 6: Compile Credential Findings Report\n\n```bash\n# Generate credential compromise assessment\npython3 \u003C\u003C 'PYEOF'\nprint(\"\"\"\nCREDENTIAL EXTRACTION REPORT\n==============================\nCase: 2024-001\nSource: memory.raw (16 GB Windows 10 memory dump)\nAnalysis Date: 2024-01-20\n\nCOMPROMISED ACCOUNTS:\n=====================\n\n1. Local Accounts (SAM):\n   - Administrator (RID 500): NTLM hash extracted\n   - svcbackup (RID 1001): NTLM hash extracted\n   - SQLService (RID 1002): NTLM hash extracted\n\n2. Domain Accounts (LSASS):\n   - CORP\\\\admin.user: NTLM hash + Kerberos TGT\n   - CORP\\\\svc.backup: NTLM hash + plaintext password (WDigest)\n   - CORP\\\\domain.admin: Kerberos TGS tickets for 3 services\n\n3. Cached Domain Credentials:\n   - CORP\\\\helpdesk.user: DCC2 hash\n   - CORP\\\\it.manager: DCC2 hash\n\n4. Cloud Credentials:\n   - AWS Access Key: AKIA... found in process memory (PID 3456)\n   - Azure AD token found in browser process memory\n\nIMMEDIATE ACTIONS REQUIRED:\n- Reset passwords for all listed accounts\n- Revoke and rotate AWS access keys\n- Invalidate all active Kerberos tickets (krbtgt reset)\n- Review DPAPI-protected data for additional exposure\n\"\"\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LSASS (Local Security Authority) | Windows process managing authentication, storing credentials in memory |\n| NTLM hash | NT LAN Manager hash of user password used for authentication |\n| Kerberos TGT | Ticket Granting Ticket allowing request of service tickets |\n| WDigest | Legacy authentication protocol storing plaintext passwords in memory (pre-Win8.1) |\n| DPAPI | Data Protection API using master keys derived from user credentials |\n| DCC2 (Domain Cached Credentials) | Cached domain password hashes for offline logon |\n| LSA Secrets | Encrypted service account passwords and other secrets stored by LSA |\n| Pass-the-Hash | Attack technique using extracted NTLM hashes without knowing the plaintext password |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Volatility 3 | Memory forensics framework with hashdump, lsadump, cachedump plugins |\n| pypykatz | Python implementation of Mimikatz for cross-platform LSASS analysis |\n| Mimikatz | Windows credential extraction tool (used offline against dumps) |\n| secretsdump.py | Impacket tool for extracting secrets from SAM\u002FSYSTEM\u002FSECURITY |\n| hashcat | Password hash cracking for recovered NTLM and DCC2 hashes |\n| John the Ripper | Alternative password cracking tool |\n| Rubeus | Kerberos ticket manipulation and extraction tool |\n| Impacket | Python toolkit for working with Windows network protocols and credentials |\n\n## Common Scenarios\n\n**Scenario 1: Post-Breach Credential Assessment**\nExtract all cached credentials from LSASS memory to determine which accounts were exposed, prioritize password resets based on privilege level, check for golden ticket material (krbtgt hash), assess if cloud credentials were accessible.\n\n**Scenario 2: Lateral Movement Investigation**\nExtract NTLM hashes and Kerberos tickets to understand how the attacker moved between systems, identify pass-the-hash\u002Fpass-the-ticket artifacts, correlate extracted credentials with network logon events in event logs.\n\n**Scenario 3: Ransomware Operator Credential Theft**\nAnalyze pre-encryption memory dump for Mimikatz execution evidence, extract all available credential types, determine if domain admin credentials were obtained, assess if krbtgt was compromised (golden ticket), plan credential rotation strategy.\n\n**Scenario 4: Cloud Credential Theft from Endpoint**\nSearch endpoint memory for AWS access keys, Azure tokens, and GCP service account keys stored by CLI tools and browsers, identify exposed cloud permissions, immediately rotate discovered credentials, audit cloud audit logs for unauthorized access.\n\n## Output Format\n\n```\nCredential Extraction Summary:\n  Source: memory.raw (16 GB, Windows 10 Build 19041)\n  LSASS PID: 684\n\n  Credentials Recovered:\n    Local NTLM Hashes:        4 accounts\n    Domain NTLM Hashes:       3 accounts\n    Kerberos TGTs:             2 tickets\n    Kerberos TGS:              5 service tickets\n    Plaintext Passwords:       1 (WDigest - svc.backup)\n    Cached Domain Creds:       2 DCC2 hashes\n    LSA Secrets:               3 service account passwords\n    DPAPI Master Keys:         4 keys recovered\n    Cloud Credentials:         1 AWS access key, 1 Azure token\n\n  Highest Privilege Compromised: Domain Admin (CORP\\domain.admin)\n\n  Recommended Actions:\n    - Immediate: Reset all extracted account passwords\n    - Immediate: Rotate AWS access key AKIA...\n    - Urgent: Double krbtgt password reset (golden ticket mitigation)\n    - High: Revoke all Kerberos tickets via krbtgt rotation\n    - Medium: Audit DPAPI-protected data exposure\n```\n",{"hide":44,"name":5,"source":45,"license":15,"description":7,"authorized_lab":40,"origin_frontmatter":46},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: extracting-credentials-from-memory-dump | description: Extract cached credentials, password hashes, Kerberos tickets, and authentication |   tokens from memory dumps using Volatility and Mimikatz for forensic investigation. | domain: cybersecurity | subdomain: digital-forensics | tags: | - forensics | - credential-extraction | - memory-forensics | - volatility | - mimikatz | - password-hashes | - incident-response | mitre_attack: | - T1005 | - T1074 | - T1119 | - T1070 | - T1003 | mitre_f3","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-extracting-credentials-from-memory-dump",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-14 03:05:17",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":44},[57,60,63],{"tool":58,"command":59},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-extracting-credentials-from-memory-dump",{"tool":61,"command":62},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-extracting-credentials-from-memory-dump",{"tool":64,"command":65},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-extracting-credentials-from-memory-dump","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-extracting-credentials-from-memory-dump\u002FSKILL.md",[],[69,93,116,146,175,194],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":39},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":39},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[100,101,80,102,103,27,104,105,106,107,108,86,109,88,110,111,112,113,114,115],"yuri shura","parallel","architecture review","planning","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":127,"publishedAt":39},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[122],{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[128,129,130,131,132,133,134,135,136,88,137,138,139,140,141,142,143,27,144,145],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":160,"publishedAt":39},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[152,155],{"categoryNo":153,"categoryName":154,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[161,90,162,128,80,163,164,165,27,166,167,168,169,170,171,172,173,174,86,88],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":39},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[182,183,184,185,186,187,188,189,190,88,191,110,192,193],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":212,"publishedAt":39},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[200,203,206,209],{"categoryNo":201,"categoryName":202,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":204,"categoryName":205,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":207,"categoryName":208,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":210,"categoryName":211,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000036","内容创作者",[213,214,215,88,110,216,80,217,104,86,218],"writing","writing skills","new","work","editing","Existing"]