value:  gsecdump can dump Windows password hashes from the SAM. ;; HOPLIGHT has the capability to harvest credentials and passwords from the SAM database. ;; SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information. ;; Ke3chang has dumped credentials including by using gsecdump. ;; Koadic can gather hashed passwords by dumping SAM/SECURITY hive. ;; menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials. ;; Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways including from the SAM table. ;; Mivast has the capability to gather NTLM password information. ;; Night Dragon has dumped account hashes with Carbanak and cracked them with Cain & Abel. ;; POWERTON has the ability to dump password hashes. ;; pwdump can be used to dump credentials from the SAM. ;; Remsec can dump the SAM database. ;; Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers. ;; Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.
name: OS Credential Dumping: Security Account Manager