6.3.5 Select a credential source on a controlled host
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
An authorized host/session with known effective token and privileges. Ordinary-user access does not grant access to every credential source.
Where to look: Start with current-user tickets and application configuration. For elevated contexts, choose among LSASS, matched SAM/SYSTEM, SECURITY/SYSTEM, Credential Manager/DPAPI or DC-specific NTDS/replication according to the exact question.
Expected behavior / secure boundary: Protected process access, VBS/Credential Guard and user/machine DPAPI boundaries can prevent collection. Missing registry values do not prove protection is off. Modern Windows does not guarantee plaintext passwords in LSASS.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.3.5.1 Baseline token and protection checks
Run: Windows. Requires: Current token; registry/process information can be restricted. Effect: Reads privilege/protection clues; does not dump LSASS.
whoami /all
tasklist /fi "imagename eq lsass.exe"
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags
6.3.5.2 Inspect the Windows runtime protection state before choosing a method Runtime protection checks using CIM
Run: Windows PowerShell. Requires: CIM availability and access to the local DeviceGuard class. Effect: Reads runtime security-service state.
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
Select-Object SecurityServicesConfigured,SecurityServicesRunning,VirtualizationBasedSecurityStatus
What this checks: The commands establish token/process/protection context before choosing a collector. They do not themselves dump credentials. A configured protection value and running security service are different kinds of evidence.
6.3.5.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Token: medium integrity; Administrators SID deny-only
LSASS process exists
RunAsPPL registry query: value not found
Memory read: access denied
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| Deny-only / medium token | The process is not equivalent to an elevated administrative token. | Inspect usable privileges and the appropriate local escalation path. | §6.1.1.1 — Establish the current identity and domain |
| LSASS exists | Normal Windows process presence. | No secret residency or readable memory is proved. | §6.3.5.1 — Select a credential source on a controlled host |
| Missing value / denied read | Protection and access remain unresolved. | Use runtime/protection evidence and an alternative authorized source; do not assume an empty store. | §6.3.5.1 — Select a credential source on a controlled host |
Stop when: One source is matched to actual token rights and protection state.
Revisit only when: Privilege, logon session, protection state or source access changes.
6.3.5.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | Exact source rights and protection conditions are satisfied: use its bounded canonical collection procedure. | §6.3.5.5 — Select a credential source on a controlled host |
| Ruled out in this context | Only ordinary-user access is available: remain with user-readable sources or escalate first. | §6.2.3.1 — Interpret scripts, configuration and exposed secrets |
| Inconclusive / failed check | Collection is denied/empty: identify the failed layer and retain uncertainty. | §6.5.1.1 — Diagnose the failed boundary |
6.3.5.5 Tooling and complete procedure
whoami, tasklist, reg and CIM are baseline state checks. Mimikatz, offline parsers and secretsdump are source-specific later choices, with exact privileges and protections documented in the owning procedure. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.