> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping.md).

# Credential Dumping

- [Cached Domain Credentials](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/cached-domain-credentials.md): MITRE ATT\&CK, Credential Access, Sub-technique T1003.005
- [Data Protection API (DPAPI)](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/data-protection-api-dpapi.md)
- [Group Policy Preferences](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/group-policy-preferences.md): MITRE ATT\&CK, Credential Access, Sub-technique T1552.006
- [LSA Secrets](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/lsa-secrets.md): MITRE ATT\&CK, Credential Access, Sub-technique T1003.004
- [LSASS Memory](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/lsass-memory.md): MITRE ATT\&CK, Credential Access, Sub-technique T1003.001
- [NTDS](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/ntds.md)
- [Security Account Manager (SAM)](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/security-account-manager-sam.md): MITRE ATT\&CK, Credential Access, Sub-technique T1003.002
- [Kerberos Tickets](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/kerberos-tickets.md): MITRE ATT\&CK, Credential Access, Technique T1558
- [Unsecured Credentials](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/unsecured_credentials-1.md): MITRE ATT\&CK, Credential Access, Technique T1552
- [WDigest](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/wdigest.md)
- [WiFi Profiles](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/os-credential-dumping/wifi-profiles.md)