MITRE D3FENDdefensive technique

D3-CR Credential Revocation

Official page ↗
Tactic
Evict

Definition

Deleting a set of credentials permanently to prevent them from being used to authenticate.

How it works

How it works Management servers with enterprise policies for account management provide the ability remove permissions, accounts, or credentials. Compromised credentials should be revoked to prevent further malicious activity.

Related

Counters · MITRE ATT&CK (25)

  • T0892 Change Credential technique
  • T1606 Forge Web Credentials technique
  • T1606.001 Web Cookies sub-technique
  • T1003.005 Cached Domain Credentials sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1134.002 Create Process with Token sub-technique
  • T1134.003 Make and Impersonate Token sub-technique
  • T1003.003 NTDS sub-technique
  • T1003.008 /etc/passwd and /etc/shadow sub-technique
  • T1110.001 Password Guessing sub-technique
  • T1110.002 Password Cracking sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1558 Steal or Forge Kerberos Tickets technique
  • T1558.001 Golden Ticket sub-technique
  • T1552 Unsecured Credentials technique
  • T1550 Use Alternate Authentication Material technique
  • T1550.001 Application Access Token sub-technique
  • T1550.004 Web Session Cookie sub-technique
  • T1098.001 Additional Cloud Credentials sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1528 Steal Application Access Token technique
  • T1134 Access Token Manipulation technique
  • T1003 OS Credential Dumping technique
  • T1098 Account Manipulation technique
  • T1110 Brute Force technique

Child of · MITRE D3FEND (1)

  • D3-CE Credential Eviction defensive technique

References