With web shell access established, Hafnium utilizes Mimikatz to extract credentials, enabling further infiltration within the network. Endpoint detection identified the execution of the Mimikatz tool to dump credentials from LSASS.