Excessive Privileges / Misconfigured Service Accounts

This record groups independent Windows credential-dumping procedures: reading credential material from LSASS logon-session memory, listing tickets already held in Kerberos logon sessions, and requesting domain credential data through Active Directory replication (DCSync). These methods require different local privileges or directory permissions and are alternatives, not sequential steps. Retrieved material may include hashes or tickets; extraction alone does not establish that the material is valid or was later used.