6.3.2 Classify recovered credentials and their scope
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
An artifact from a readable file, selected offline recovery or an authorized credential source. Its account scope and format must be known before reuse.
Where to look: Record the artifact's originating host/object, username/domain or local scope, format and protection. Distinguish plaintext, NT hash, Net-NTLM response, cached verifier, AES key, TGT/service ticket, certificate and DPAPI blob.
Expected behavior / secure boundary: A hash-looking string is not a universal login credential. SAM describes local accounts; cached-domain verifiers are not directly passable NT hashes; a service ticket is scoped to a service identity and validity conditions.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.3.2.1 Baseline selection
Select the prerequisite check indicated by the interpreted result below. This chooser requires no additional tool or state change.
What this checks: Choose the next protocol only after classification. This prevents running password, hash and ticket commands against incompatible material. Use the complete credential procedures for format-specific cracking and validation.
6.3.2.2 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Origin: APP01 matched SAM + SYSTEM
Account: Administrator
Material: local-account NT hash
Target proposal: DC01 / domain Administrator
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| APP01 SAM | A member host's local-account source. | Treat the identity as APP01-local unless separate evidence supports reuse. | §6.3.2.1 — Classify recovered credentials and their scope |
| NT hash | May support NTLM-compatible authentication. | Check tool support, target account scope, NTLM policy and authorization. | §6.4.1.1 — Select a compatible remote-access mechanism |
| Proposed domain Administrator use | An unsupported identity jump. | Do not equate local and domain accounts sharing a name. | §6.2.1.1 — Baseline enumeration — users and groups |
Stop when: Origin, identity scope, material format and a compatible next use are established.
Revisit only when: A new parser result, account mapping or protocol policy changes compatibility.
6.3.2.3 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | Format, identity, route and supported authentication match: validate the selected service. | §6.4.1.1 — Select a compatible remote-access mechanism |
| Ruled out in this context | A captured response is supplied to an NT-hash option: reject that incompatible use. | §6.3.2.1 — Classify recovered credentials and their scope |
| Inconclusive / failed check | Origin/format/account is unknown: classify it before trying tools. | §6.3.2.1 — Classify recovered credentials and their scope |
6.3.2.4 Tooling and complete procedure
No new collection tool is needed to classify an artifact. Use source-specific parsers and the existing credential procedure; do not print real secrets in reusable notes. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.