Thycotic Secret Server: Offline Decryption Methodology

This walkthrough demonstrates an offline method to extract and decrypt secrets from Thycotic Secret Server (TSS) v10.x by dumping tbSecret/tbSecretItem entries via SQL, collecting encryption.config and Thycotic DLLs from the webroot, and using provided PowerShell scripts to decrypt ItemValue fields; it includes processing steps, example queries, caveats about newer TSS formats, and defensive recommendations (MFA, DPAPI/HSM protection for encryption.config, firewalling, monitoring).