Procedure examples

Empire can perform pass the hash attacks.

PoshC2 has a number of modules that leverage pass the hash for lateral movement.

Pass-The-Hash Toolkit can perform pass the hash.

Mimikatz's SEKURLSA::Pth module can impersonate a user, with only a password hash, to execute arbitrary commands.

CrackMapExec can pass the hash to authenticate via SMB.

APT32 successfully gained remote access by using pass the ticket.

APT29 used Kerberos ticket attacks for lateral movement.

BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.

Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.

Mimikatz’s LSADUMP::DCSync and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.

Pupy can also perform pass-the-ticket.

During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged `duo-sid` cookie to bypass MFA set on an email account.

Star Blizzard has bypassed multi-factor authentication on victim email accounts by using session cookies stolen using EvilGinx.

Leviathan gathered credentials hardcoded in binaries located on victim devices during Leviathan Australian Intrusions.

Volt Typhoon has obtained credentials insecurely stored on targeted network appliances.

DarkGate uses NirSoft tools to steal user credentials from the infected machine. NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.

Astaroth uses an external software known as NetPass to recover passwords.

NPPSPY captures credentials by recording them through an alternative network listener registered to the mpnotify.exe process, allowing for cleartext recording of logon information.

Pacu can search for sensitive data: for example, in Code Build environment variables, EC2 user data, and Cloud Formation templates.

During SharePoint ToolShell Exploitation, threat actors accessed web.config and machine.config to extract MachineKey values, enabling them to forge legitimate VIEWSTATE tokens for future deserialization payloads.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to extract authentication certificates stored in system configuration files across compromised environments.

Leviathan gathered credentials stored in files related to Building Management System (BMS) operations during Leviathan Australian Intrusions.

Indrik Spider has searched files to obtain and exfiltrate credentials.

APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.

Kimsuky has used tools that are capable of obtaining credentials from saved mail.

MuddyWater has run a tool that steals passwords saved in victim email.

Leafminer used several tools for retrieving login and password information, including LaZagne.

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.

Scattered Spider Spider searches for credential storage documentation on a compromised host.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

TA505 has used malware to gather credentials from FTP clients and Outlook.

RedCurl used LaZagne to obtain passwords in files.

Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.

Fox Kitten has accessed files to gain valid credentials.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

FIN13 has obtained administrative credentials by browsing through local files on a compromised machine.

TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.

Smoke Loader searches for files named logins.json to parse for credentials.

Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.

Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.

BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.

XTunnel is capable of accessing locally stored passwords on victims.

If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.

StrelaStealer searches for and if found collects the contents of files such as `logins.json` and `key4.db` in the `$APPDATA%\Thunderbird\Profiles\` directory, associated with the Thunderbird email application.

Pysa has extracted credentials from the password database before encrypting the files.

Shai-Hulud has gathered sensitive data stored in the Node.JS file `process.env` to include credentials and API keys. Shai-Hulud has harvested credentials stored in config files and credential files in victim environments to include `~/.aws/credentials`, `application_default_credentials.json`, and `azureProfile.json`. Shai-Hulud has also targeted credentials and tokens stored in NPM files `.npmrc` and GitHub config files.

Agent Tesla has the ability to extract credentials from configuration or support files.

jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.

Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.

AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine.