MITRE D3FENDdefensive technique

D3-ANCI Authentication Cache Invalidation

Official page ↗
Tactic
Evict

Definition

Removing tokens or credentials from an authentication cache to prevent further user associated account accesses.

How it works

How it works Applications can locally cache user authentication credentials for certain server connections. An application may attempt to use the cached credential for a connection. If the cached credentials exist then the user will not be typically prompted for new credentials. Considerations Are these cached credentials only on the local host? Can they be persisted to the remote server? Examples Windows Credential Management API

Related

Counters · MITRE ATT&CK (25)

  • T0892 Change Credential technique
  • T1606 Forge Web Credentials technique
  • T1606.001 Web Cookies sub-technique
  • T1003.005 Cached Domain Credentials sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1134.002 Create Process with Token sub-technique
  • T1134.003 Make and Impersonate Token sub-technique
  • T1003.003 NTDS sub-technique
  • T1003.008 /etc/passwd and /etc/shadow sub-technique
  • T1110.001 Password Guessing sub-technique
  • T1110.002 Password Cracking sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1558 Steal or Forge Kerberos Tickets technique
  • T1558.001 Golden Ticket sub-technique
  • T1552 Unsecured Credentials technique
  • T1550 Use Alternate Authentication Material technique
  • T1550.001 Application Access Token sub-technique
  • T1550.004 Web Session Cookie sub-technique
  • T1098.001 Additional Cloud Credentials sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1528 Steal Application Access Token technique
  • T1134 Access Token Manipulation technique
  • T1003 OS Credential Dumping technique
  • T1098 Account Manipulation technique
  • T1110 Brute Force technique

Child of · MITRE D3FEND (1)

  • D3-CE Credential Eviction defensive technique

References