Windows Possible Credential Dumping
LSASS Memory, OS Credential Dumping
LSASS Memory, OS Credential Dumping
Modify Registry
Command and Scripting Interpreter, PowerShell
Domain Account, Account Discovery
Disable or Modify Tools, Impair Defenses