In one incident, the threat actor used the Wrapikatz tool (w.exe) with a usage statement that retrieves various passwords and Windows credentials from memory and compiles them in w.txt: c:\programdata\w.exe –w –l –c>>c:\programdata\w.txt In a separate incident, the threat actor used access provided by extensive web shell deployment to harvest account credentials:  2016-10-03T09:27:47   dir 2016-10-03T09:28:11   w64.log >ppp.log 2016-10-03T09:30:10     PowerShell.exe -ExecutionPolicy Bypass -File getpwd.ps1 >iistail.log  In another example, BRONZE UNION leveraged the Kekeo credential abuse tool to exploit CVE-2014-6324, a vulnerability in Microsoft's implementation of the Kerberos network authentication protocol