OS Credential Dumping

/etc/passwd and /etc/shadow

Cached Domain Credentials

DCSync

LSA Secrets

LSASS Memory

NTDS

Proc Filesystem

Security Account Manager