They See Me Roaming: Following APT29 by Taking a Deeper Look at Windows Credential Roaming

https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming

https://cqureacademy.com/blog/extracting-roamed-private-keys

…