Finding credentials in pagefile.sys

The pagefile is famously where credentials end up that nobody meant to write to disk. Software handles secrets in memory constantly: HTTP clients build Authorization headers, browsers decrypt saved passwords on autofill, database drivers concatenate connection strings, SSH agents hold private keys, OAuth flows pass bearer tokens around. The Memory Manager has no idea which of those allocations are sensitive. When memory pressure picks a cold page, that page goes to C:\pagefile.sys in the clear.

This post is the field guide to the credential shapes I look for first, with the practical sweeps that pay back the time.

Why it happens

The kernel does not know what is inside a page. It only knows how cold it is. Modern process memory holds:

HTTP request and response buffers with Authorization headers in plain text.
WebView, Chrome, Edge tabs that decrypt DPAPI-protected saved passwords into RAM when the user autofills a form.
Database client libraries that construct Server=...;Password=... connection strings, often without ever clearing them.
JWTs cached in JS heaps (browser tabs, Electron apps, Teams, Slack, Discord).
lsass.exe working set. When LSASS pages cool, fragments with NTLM hashes, Kerberos tickets, and LSA secrets land on disk.
CLI tools: AWS CLI, gcloud, az, kubectl all keep recently-issued credentials in memory.

None of these were supposed to write the secret to a file. They have no protection against the OS evicting the page they live in. pagefile.sys is then a long-lived on-disk copy of what was hot in RAM but is no longer quite hot enough.

What to search for

This parser's artifact regex sweeps include a credential category. If you are hand-grepping a strings export with grep -aE, here are the productive shapes.

Plaintext password fields

password=
pwd=
passwd=
PASSWORD=
Pwd=

Found inside connection strings:

Server=db01;Database=app;User Id=app_rw;Password=hunter2;

And inside HTTP form bodies:

username=admin&password=hunter2&csrf=...

HTTP Authorization headers

Authorization: Basic dXNlcjpwYXNzd29yZA==
Authorization: Bearer eyJ...
Authorization: Negotiate YIIE...

Basic base64-decodes to user:password. Bearer is usually an opaque token or a JWT. Negotiate is wrapped Kerberos / SPNEGO and the inner blob can yield service principal names and occasionally usable ticket material.

JWTs

Three base64url segments separated by dots, starting with eyJ:

eyJhbGciOiJSUzI1NiIsImtpZCI6Ii4uLiJ9.eyJzdWIiOiI...".dHJ1c3RtZQ

The first segment is the header (alg, kid). The second is the claims (sub, iss, aud, exp). Anything inside its exp window is potentially still usable, and tokens issued by misconfigured systems (long expiries, no rotation) often outlive the engagement.

NTLM and Kerberos

NTLMSSP messages start with 4E 54 4C 4D 53 53 50 00, the magic NTLMSSP\0.
Type-2 challenges carry the server challenge nonce; Type-3 responses carry Net-NTLMv1/v2 hash material. Crack offline with hashcat (-m 5500 for v1, -m 5600 for v2).
Kerberos tickets show up as large binary blobs near the strings krbtgt, LSA Kerberos, or service principal names (HTTP/host, MSSQLSvc/host). Extracting full tickets from a pagefile is harder than from RAM, but TGT/TGS material does survive often enough to be worth the search.

LSA secrets and Domain Cached Credentials

lsass.exe keeps secret material in memory. When the LSASS working set cools enough to evict, fragments paged out can include:

DCC2 (MS-Cache v2): 16-byte hashes near NL$KM and _SC_ strings.
Service-account passwords in plaintext if LsaCfgFlags is not set (LSA in protected mode mitigates this; most enterprises still have not turned it on).

Full decode wants pypykatz or mimikatz against a memory image. The raw fragments are still findable in pagefile and worth flagging.

SSH and PGP key material

OpenSSH private keys begin with -----BEGIN OPENSSH PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----. PGP secret keys with -----BEGIN PGP PRIVATE KEY BLOCK-----. When an agent has the key unlocked, the unlocked material lives in memory until the agent clears it, which means it can page out.

Cloud CLI tokens

AWS: aws_access_key_id, aws_secret_access_key, aws_session_token. STS tokens are often JWT-shaped.
GCP: gcloud auth cached access_token and refresh tokens, often in JSON.
Azure: Az.Accounts cached tokens, MSAL.Token shapes, the TokenCache.dat file's in-memory representation.
Kubernetes: service-account JWTs (eyJhbGciOiJSUzI1NiIsImtpZCI...).

Database client artifacts

ODBC / OLEDB connection strings: Provider=...;Data Source=...;User ID=...;Password=...;.
sqlcmd -P, mysql -p, psql --password argument values. These survive on the command line too. See malware command lines for the related sweep.

Browser-saved passwords

Chrome, Edge, and Brave store saved passwords encrypted via DPAPI. They decrypt on autofill, and the plaintext lives briefly in the renderer's heap. A pagefile captured shortly after an active browsing session frequently holds those decrypted forms. Pair with the browser history artifacts on the same host to anchor which sites the user authenticated to.

How this parser surfaces them

The Artifacts → Credential indicators tab matches:

password= / pwd= / passwd= in any string.
Authorization: Bearer ... and Authorization: Basic ... headers.
JWT-shaped tokens (three base64url segments separated by dots, starting with eyJ).

The Strings tab is the catch-all. Filter for Authorization, NTLMSSP, BEGIN OPENSSH, aws_secret, Bearer, Cookie: and read what surrounds the hit. Anything that is a binary blob (NTLM challenge bytes, Kerberos tickets) will not appear as a string but will land in the high-entropy bucket on the Page map. That is where to look next.

Operational notes

Time matters. The longer a host runs after a credential was loaded, the higher the chance the page was overwritten by newer paged-out content. Acquire pagefile as soon as you suspect compromise.
A paired RAM dump is multiplicatively more useful for credential hunting. It gives you live LSASS, the full Kerberos cache, and process-attributable secrets. The limitations post explains why standalone pagefile cannot give you process attribution.
Do not reboot the suspect host before grabbing pagefile. Windows will overwrite paged-out slots on the next boot. If a reboot is forced on you, capture first.
hiberfil.sys beats pagefile for credential recovery when present. It is a full RAM snapshot. See the comparison post.
Cross-anchor every recovered credential with EVTX logon events (4624, 4648), the registry SECURITY hive (LSA secrets, machine account), and outbound network connections from Sysmon. A credential without a timeline is half a finding.

Legal note

Only analyse pagefiles from systems you are authorised to investigate. Plaintext credentials extracted from someone else's machine are still credentials, and using them outside the engagement scope is a separate offense entirely.