LSASS memory dumping (with appropriate safeguards) - Kerberoasting and AS-REP roasting - NTLM relay and credential forwarding - Keylogging (with ROE authorization) - Credential file discovery (password files, configuration files, browser storage)