Credential Access

Mimikatz, comsvcs.dll, procdump, and NTDS extraction pulling hashes and plaintext from memory or disk.

Detect it with
Sysmon Event ID 10 — process access to lsass.exe with 0x1010/0x1410; volume shadow copy creation on a domain controller.

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.

Detect it with
Detecting the events leading up to sniffing network traffic may be the best method of detection.

Keyloggers and credential-prompt spoofing capturing what the user types.

Detect it with
SetWindowsHookEx usage; unexpected processes registering raw input devices.

Password spraying, credential stuffing, and password guessing against exposed authentication surfaces.

Detect it with
Event ID 4625 across many accounts from one source (spray) or many sources for one account; cloud sign-in failure spikes.

Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources.

Detect it with
Detecting use of proxied smart card connections by an adversary may be difficult because it requires the token to be inserted into a system; thus it is more likely to be in use by a legitimate user and blend in with other network behavior.

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

Detect it with
Monitor for SMB traffic on TCP ports 139, 445 and UDP port 137 and WebDAV traffic attempting to exit the network to unknown external systems. If attempts are detected, then investigate endpoint data sources to find the root cause.

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

Detect it with
Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash.

OAuth tokens and cloud session cookies stolen to bypass MFA entirely.

Detect it with
Same session token used from two ASNs; illicit consent grants to newly registered applications.

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

Detect it with
Monitor for attempts to access files and repositories on a local system that are used to store browser session cookies. Monitor for attempts by programs to inject into or dump browser process memory.

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g.

Detect it with
While detecting adversaries accessing credentials may be difficult without knowing they exist in the environment, it may be possible to detect adversary use of credentials they have obtained.

Browser saved passwords, keychains, and password manager databases harvested from disk.

Detect it with
Non-browser processes reading Login Data or logins.json; access to .kdbx and keychain files by new binaries.

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Detect it with
Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer.

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for…

Detect it with
Monitor network traffic for anomalies associated with known AiTM behavior. Consider monitoring for modifications to system configuration files involved in shaping network traffic flow.

Kerberoasting, AS-REP roasting, golden and silver tickets abusing Kerberos design.

Detect it with
Event ID 4769 with RC4 encryption (0x17) for many SPNs from one account; TGTs with implausible lifetimes.

Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.

Detect it with
Monitor for anomalous authentication activity, such as logons or other user session activity associated with unknown accounts.

Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.

Detect it with
Monitor user account logs as well as 2FA/MFA application logs for suspicious events: unusual login attempt source location, mismatch in location of login attempt and smart device receiving 2FA/MFA request prompts, and high volume of repeated login attempts, all of which may…

Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.