## Overview
Credential dumping activity was observed, a common technique used by APT17 to facilitate lateral movement within the targeted network.

## Key Findings
- **Tools Used**: Mimikatz was employed to extract credentials from the Local Security Authority Subsystem Service (LSASS).
- **Lateral Movement**: Stolen credentials were used to access additional systems, expanding the attack surface.

## Recommendations
- **Credential Hygiene**: Enforce multi-factor authentication and regular password changes.
- **Monitoring and Alerts**: Enhance logging and alerting for suspicious account activities.