Credential Dumping

An attack technique where user credentials (e.g., passwords, hashes, tokens) are extracted from a system, often for lateral movement or privilege escalation. Forensic investigators check for these signs in memory dumps and system logs.