TA0006 · CREDENTIAL ACCESS
Password Cracking
Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.
Detect it with
It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network. Consider focusing efforts on detecting other adversary behavior used to acquire credential materials, such as OS Credential Dumping or Kerberoasting.
Why it matters on shift
Password Cracking is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context