MITRE ATT&CK Enterprise techniques whose primary tactic is Credential Access: detection with open-source tooling and cyber range exercises.
Detecting T1003 OS Credential Dumping on Linux, macOS and Windows, using telemetry such as File Access, Process Creation and Process Access. Covers its 8 sub-techniques, the ATT&CK mitigations User Training and Encrypt Sensitive Information, and how to rehearse the detection in a cyber range.
Detecting T1040 Network Sniffing on IaaS, Linux, macOS and Network Devices and other platforms, using telemetry such as User Account Authentication, Process Creation and Network Traffic Content. Covers the ATT&CK mitigations User Account Management and Encrypt Sensitive Information and how to rehearse the detection in a cyber range.
Detecting T1110 Brute Force on Containers, ESXi, IaaS and Identity Provider and other platforms, using telemetry such as User Account Authentication. Covers its 4 sub-techniques, the ATT&CK mitigations User Account Management and Password Policies, and how to rehearse the detection in a cyber range.
Detecting T1111 Multi-Factor Authentication Interception on Linux, macOS and Windows, using telemetry such as Process Creation, Process Access and Logon Session Creation. Covers the ATT&CK mitigation User Training and how to rehearse the detection in a cyber range.
Detecting T1187 Forced Authentication on Windows, using telemetry such as Network Traffic Content, File Creation and File Modification. Covers the ATT&CK mitigations Password Policies and Filter Network Traffic and how to rehearse the detection in a cyber range.
Detecting T1212 Exploitation for Credential Access on Linux, Windows, macOS and Identity Provider, using telemetry such as User Account Authentication, Process Creation and Process Access. Covers the ATT&CK mitigations Update Software and Application Isolation and Sandboxing and how to rehearse the detection in a cyber range.
Detecting T1528 Steal Application Access Token on Containers, IaaS, Identity Provider and Office Suite and other platforms, using telemetry such as File Access, User Account Authentication and Application Log Content. Covers the ATT&CK mitigations User Training and User Account Management and how to rehearse the detection in a cyber range.
Detecting T1539 Steal Web Session Cookie on Linux, macOS, Office Suite and SaaS and other platforms, using telemetry such as File Access, User Account Authentication and Process Creation. Covers the ATT&CK mitigations User Training and Audit and how to rehearse the detection in a cyber range.
Detecting T1552 Unsecured Credentials on Windows, SaaS, IaaS and Linux and other platforms, using telemetry such as Process Creation, File Access and User Account Authentication. Covers its 8 sub-techniques, the ATT&CK mitigations User Training and Audit, and how to rehearse the detection in a cyber range.
Detecting T1555 Credentials from Password Stores on IaaS, Linux, macOS and Windows, using telemetry such as File Access, Process Creation and Process Access. Covers its 6 sub-techniques, the ATT&CK mitigations Password Policies and Update Software, and how to rehearse the detection in a cyber range.
Detecting T1557 Adversary-in-the-Middle on Linux, macOS, Network Devices and Windows, using telemetry such as Application Log Content, Network Traffic Content and File Modification. Covers its 4 sub-techniques, the ATT&CK mitigations User Training and Encrypt Sensitive Information, and how to rehearse the detection in a cyber range.
Detecting T1558 Steal or Forge Kerberos Tickets on Linux, macOS and Windows, using telemetry such as File Access, Process Access and Logon Session Metadata. Covers its 5 sub-techniques, the ATT&CK mitigations Audit and Encrypt Sensitive Information, and how to rehearse the detection in a cyber range.
Detecting T1606 Forge Web Credentials on SaaS, Windows, macOS and Linux and other platforms, using telemetry such as File Access, Process Access and Network Traffic Content. Covers its 2 sub-techniques, the ATT&CK mitigations User Account Management and Audit, and how to rehearse the detection in a cyber range.
Detecting T1621 Multi-Factor Authentication Request Generation on Windows, Linux, macOS and IaaS and other platforms, using telemetry such as User Account Authentication, Application Log Content and Logon Session Metadata. Covers the ATT&CK mitigations User Training and Multi-factor Authentication and how to rehearse the detection in a cyber range.
Detecting T1649 Steal or Forge Authentication Certificates on Windows, Linux, macOS and Identity Provider, using telemetry such as File Access, Application Log Content and Command Execution. Covers the ATT&CK mitigations Audit and Encrypt Sensitive Information and how to rehearse the detection in a cyber range.
Detecting T1697 Steal Application Specific Passwords on Office Suite, Identity Provider and SaaS, using telemetry such as User Account Authentication, Application Log Content and Logon Session Creation. Covers the ATT&CK mitigations User Training and User Account Management and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.