# Credential Dumping Investigated

With persistence ensured, TA505's next step involves credential dumping to facilitate lateral movement across the network.

## Tools and Techniques:
- **Mimikatz Usage**: Evidence of Mimikatz being used to extract credentials from memory.
- **SAM and SYSTEM File Access**: Unauthorized access to SAM and SYSTEM files was detected.

## Defensive Measures:
- Employ endpoint detection and response (EDR) solutions to identify and alert on credential dumping activities.
- Implement least privilege access and ensure sensitive accounts use multi-factor authentication.