Credential dumping

Several stores hold usable material. The memory of the authentication subsystem on Windows holds credentials for sessions that are currently logged on, which is why a workstation an administrator has used is worth more than the administrator’s own machine. The local account database holds hashes for local accounts. The directory database on a domain controller holds every hash in the domain. The data protection subsystem holds secrets for saved credentials and browser stores. On Linux and macOS the equivalents are the shadow file, keyrings and configuration holding tokens.

What is recovered decides what happens next. A plaintext password can be typed anywhere. A hash can be replayed directly, which is pass-the-hash. A Kerberos ticket can be reused until it expires. A cloud or application token can be reused without touching the directory at all.

The reason this keeps working is not a missing patch, it is where privileged accounts have been used. Every interactive logon by a privileged account leaves material on the machine it logged into, so an administrator troubleshooting a user’s laptop deposits domain credentials on a host that is, by definition, having problems. That is the mechanism behind almost every attack path we draw from a standard user to domain administrator.

The controls exist and are patchily applied. Protecting the authentication subsystem so ordinary administrative rights cannot read its memory, virtualisation-based credential isolation, and tiering so that privileged accounts never log on to lower-trust machines are the three that change the outcome. The first two are settings; the third is an operating model, which is why it is the one that is missing. Meanwhile attackers increasingly avoid the well-known tooling entirely and use signed system utilities to produce a memory image for offline parsing, which is living off the land and defeats detection based on tool names.

We report the account recovered, the host it came from, the store it came from, and above all why that account was on that host, because the last item is the fix. Recovered secrets never appear in the report body. Severity follows what the credential reached, and the recommendation is normally an administrative tiering change rather than a technical control, which is a harder conversation and the correct one. This is part of how one compromised host becomes a route through the estate.