skills.rest
Yenn503
Yenn503COMMUNITY
Explore all skills by this author →
WebsiteGitHub

extracting-credentials-from-memory-dump

Extract credentials, hashes, and Kerberos tickets from Windows memory dumps using Volatility and pypykatz.

1|1|Updated Apr 3, 2026
Search Tags:#incident response#volatility#mimikatz#kerberos#memory forensics#credential extraction#pypykatz
One-click install
npx skills add https://github.com/Yenn503/Net-Runners --skill extracting-credentials-from-memory-dump-yenn503
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: extracting-credentials-from-memory-dump
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/forensics/extracting-credentials-from-memory-dump
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill extracting-credentials-from-memory-dump-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires volatility3, pypykatz.

What problem does it solve? During incident response and breach investigations, analysts need to determine which credentials were exposed in a compromised system's memory. This Skill provides a structured workflow for extracting NTLM hashes, Kerberos tickets, plaintext passwords, DPAPI keys, and cloud tokens from memory dumps so teams can scope credential compromise and plan resets. ## Core Features & Use Cases - Hash and Secret Extraction: Dump SAM database hashes, LSA secrets, and cached domain credentials using Volatility 3 plugins (hashdump, lsadump, cachedump). - LSASS Analysis: Dump LSASS process memory and parse it with pypykatz to recover NTLM hashes, Kerberos TGT/TGS tickets, WDigest plaintext passwords, and DPAPI master keys. - Token and Cloud Credential Discovery: Search process memory strings for AWS access keys, Azure tokens, session cookies, and API keys. - Use Case: After a ransomware incident, analyze a pre-encryption memory dump to determine whether domain admin credentials or the krbtgt hash were compromised, then produce a prioritized password reset and ticket revocation plan. ## Quick Start Analyze the memory dump at /cases/case-2024-001/memory/memory.raw and extract all credentials, Kerberos tickets, and cloud tokens into a compromise assessment report.

Frequently Asked Questions about extracting-credentials-from-memory-dump

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract credentials from a Windows memory dump?▼

Use Volatility 3 to identify the LSASS process and dump its memory, then parse the dump with pypykatz to recover NTLM hashes, Kerberos tickets, and plaintext passwords. Volatility plugins like hashdump, lsadump, and cachedump extract SAM hashes and cached domain credentials directly.

How to dump LSASS memory with Volatility 3?▼

Run windows.pslist to find the LSASS PID, then use windows.memmap with the --pid and --dump flags to write the process memory to a file. The resulting .dmp file can be analyzed offline with pypykatz or Mimikatz.

What is the difference between pypykatz and Mimikatz for memory analysis?▼

pypykatz is a Python implementation of Mimikatz that runs on Linux and parses LSASS dump files offline, making it suitable for forensic workstations. Mimikatz runs on Windows and is typically used against live systems or dumps in a Windows analysis environment.

Can Volatility extract Kerberos tickets from a memory dump?▼

Volatility itself focuses on hashes and LSA secrets, but pypykatz can parse an LSASS dump and export Kerberos tickets as .kirbi files using the -k output directory flag. These tickets include TGTs and service tickets from active logon sessions.

Why does credential extraction fail on some memory dumps?▼

Extraction fails when the dump format is unsupported, Windows symbol tables are missing for the OS version, or LSASS memory is corrupted or paged out. Verify the OS build with windows.info and confirm LSASS appears in the process list before dumping.

Is it legal to extract credentials from memory dumps?▼

Credential extraction is a standard digital forensics and incident response technique but requires appropriate legal authorization, such as ownership of the system or a formal investigation mandate. The workflow explicitly lists legal authorization as a prerequisite.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

acquiring-disk-image-with-dd-and-dcfldd

Create bit-for-bit forensic disk images with dd and dcfldd using hash verification.

Community
Intermediate
blacklanternsecurityblacklanternsecurity
253

credential-cracking

Crack password hashes and encrypted files using hashcat and john.

Official
Advanced
xalgordxalgord
954

detecting-lateral-movement-in-network

Detect lateral movement in enterprise networks using Zeek logs, Windows events, and SIEM correlation rules.

Community
Advanced
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced