Reading the passwords out of memory Start this lab

Why this matters

Reading credential memory on a domain controller is the step that turns a single compromised machine into the whole estate. Everything signed in on that machine is exposed the moment the read succeeds, so the response is measured in rotations, not removals.

Concepts

Objectives graded

• Name the process whose memory was read and the rights the tool asked for
• Decide a verdict on the tool before it is removed
• Rotate every credential the read exposed behind an approval gate

MITRE ATT&CK coverage

The memory of the process that holds every signed-in credential was opened on a domain controller — the read that turns one machine into the whole estate.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The learner named the process whose memory was read.

  investigation · weight 20 · T1003.001 OS Credential Dumping: LSASS Memory (Credential Access)

• The dumping tool was judged rather than deleted on sight.

  investigation · weight 15 · T1003 OS Credential Dumping (Credential Access)

• The credentials the read exposed were rotated, not merely flagged.

  behavior · weight 20 · T1078.002 Valid Accounts: Domain Accounts (Defense Evasion)

Common mistakes

• Removing the binary and closing the case without rotating anything.
• Rotating the one named account while other sessions on the same machine stay valid.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.