Credential Dumping

Definitions

1. The extraction of passwords, hashes, tickets, or other authentication material from memory, disk, or security databases on a compromised system. Credential dumping is a common post-exploitation step because it enables lateral movement and privilege escalation.

   In plain English: Stealing stored or in-memory login credentials from a system.

   Example: "The EDR alert fired when the malware attempted credential dumping from LSASS memory."

Related Terms

• Execution Policy
• Secret Scanning
• Active Directory
• Bitlocker
• Group Policy
• Kerberos
• Living off the Land
• NTLM
• C2 Framework
• Credential Guard
• Credential Theft