Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
Tactics
TA0006
Sub-technique of
T1003
See: MITRE ATT&CK