Credential Theft: Expanding Your Reach

This Huntress report outlines credential theft tactics across the attack lifecycle: common initial access methods (phishing, malicious downloads, brute force, vulnerable exposed services), and post-exploitation techniques for harvesting credentials (infostealers, password recovery tools, Mimikatz, Registry hive and LSASS memory dumps, enabling WDigest, and NTDS.dit extraction). The document includes observed command examples, abuse of LOLBins and Volume Shadow Copies, and recommended controls such as security awareness, asset inventory, attack surface reduction, and endpoint monitoring to detect and mitigate these activities.