Windows credential access: where secrets live and how they leave

You are admin or SYSTEM on a Windows host. The next move is rarely another exploit; it is credentials, because a reused hash or a cached domain password turns one box into the next one. This maps where Windows stores secrets and how each store is read. The emphasis is detection: every one of these leaves a narrow, high-signal trace, and this post is as much a blue-team checklist as a red-team one. The extraction tools (mimikatz, the Impacket secretsdump, pypykatz, the SharpDPAPI and Rubeus family) are named, not carried; the point is the mechanism and the signal.

Local account hashes: the SAM and SYSTEM hives

Local account NT hashes live in the SAM hive, encrypted with a key in SYSTEM. With admin rights you copy both and parse them offline:

reg save HKLM\SAM sam.save & reg save HKLM\SYSTEM system.save

Offline, the usual tooling turns those into NT hashes for pass-the-hash or cracking. Detect: reg save (or reg.exe / esentutl / VSS) touching SAM, SYSTEM, or SECURITY; process-creation event 4688 with that command line. Harden: rotate and randomize local admin passwords with LAPS so a recovered local hash is useless elsewhere, and keep local admin off where it is not needed. Reaching the admin rights this needs in the first place is covered in Windows local privilege escalation, which also uses these hives via SeBackup/SeRestore.

Logon secrets in memory: LSASS

lsass.exe holds the secrets of active logons: NT hashes, Kerberos tickets, and on older or misconfigured systems (WDigest enabled) plaintext. The common path is to dump the process and parse it offline, often with a living-off-the-land minidump rather than a known tool:

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass_pid> C:\Windows\Temp\l.dmp full

Detect, and this is the single highest-value credential detection you can run: process access to lsass.exe with suspicious rights (Sysmon event 10, GrantedAccess such as 0x1010 or 0x1410), the comsvcs.dll MiniDump command line, and any .dmp written near lsass. Harden: enable Credential Guard, run LSASS as a protected process (RunAsPPL), turn on the Defender attack-surface-reduction rule that blocks LSASS credential theft, disable WDigest, and keep SeDebugPrivilege tightly held.

LSA secrets and cached domain logons

The SECURITY hive holds LSA secrets (service account passwords, machine account secret) and the cached domain credentials (MSCache v2 / DCC2) that let domain users log on when the DC is unreachable. Extraction reads the same saved hives as above with the LSA option. Detect: access to the SECURITY hive, the same reg save signal. Harden: limit cached logons (CachedLogonsCount), Credential Guard, and strong service-account secrets.

DPAPI: the key to everything a user saved

The Data Protection API encrypts browser passwords, Credential Manager entries, saved RDP and Wi-Fi secrets, and more. With a user's masterkey (derived from their password, or recovered as SYSTEM, or via the domain DPAPI backup key from a DC) the SharpDPAPI family decrypts all of it. Detect: access to ...\Microsoft\Protect\ masterkey files, and the extremely high-signal case of the DPAPI domain backup key being pulled from a DC. Harden: Credential Guard, and protect the domain backup key as a tier-0 secret.

Stored credentials and credential files

Quick wins that need no memory access:

cmdkey /list
vaultcmd /listcreds:"Windows Credentials" /all
where /r C:\ unattend.xml sysprep.xml Groups.xml web.config

unattend.xml, SYSVOL Groups.xml (the classic Group Policy Preferences cpassword, decryptable with a public key), web.config, scripts, and KeePass or browser stores all leak secrets. Detect: SYSVOL reads for cpassword, access to known credential files. Harden: remove GPP passwords (patched but residue lingers in SYSVOL), scrub unattend files, and keep secrets out of scripts and shares.

Domain-wide: DCSync

With replication rights (DS-Replication-Get-Changes and ...-All, held by Domain Admins and often over-delegated), any principal can ask a domain controller to replicate account secrets, including the krbtgt hash that enables golden tickets, without touching a DC's disk or LSASS. Detect, and this is the cleanest domain-wide signal: directory-service access event 4662 referencing the replication GUIDs, or a DRSUAPI replication request from a host that is not a domain controller. Harden: audit and minimize who holds replication rights, and alert on replication from non-DC sources. DCSync replication abuse covers the rights, the SACL setup, and the detection in full, and coerced NTLM relay to DCSync shows how a foothold reaches those rights without a privileged password.

Detection, consolidated

The blue-team shortlist, highest value first:

• LSASS access. Sysmon 10 with sensitive GrantedAccess, any MiniDump via comsvcs.dll, and .dmp files near lsass. Turn this on first.
• DCSync from a non-DC. 4662 with replication GUIDs, or DRSUAPI from a non-DC IP. Near-zero false positives.
• Hive theft. reg save / esentutl / VSS against SAM, SYSTEM, SECURITY.
• DPAPI backup key pulled from a DC, and masterkey-directory access.
• GPP / SYSVOL reads hunting cpassword, and access to known credential files.
• Collect 4688 with command line and deploy Sysmon; most of the above is invisible without them.

Hardening, consolidated

Credential Guard and LSASS as a protected process with the ASR rule; LAPS for local admin passwords; a tiered-admin model so a dumped workstation credential cannot reach a DC; disable WDigest; limit cached logons; minimize and monitor replication rights; and protect the DPAPI domain backup key and krbtgt as tier-0. Each closes one of the stores above.

Use

Authorized and educational use only: your own systems, a lab you control, or an engagement with written permission. This describes where credentials live and how their extraction looks so defenders can detect and close it; it carries no extraction tooling and is not for use against systems you do not own.