MITRE ATT&CKtactic
TA0006 Credential Access
- Domain
- enterprise
- Version
- 1.0
- Created
- 2018-10-17
Description
The adversary is trying to steal account names and passwords.
Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
Related
Referenced by MITRE ATT&CK · tactic (68)
- T1697 Steal Application Specific Passwords technique
- T1557.004 Evil Twin sub-technique
- T1558.005 Ccache Files sub-technique
- T1556.009 Conditional Access Policies sub-technique
- T1555.006 Cloud Secrets Management Stores sub-technique
- T1556.008 Network Provider DLL sub-technique
- T1552.008 Chat Messages sub-technique
- T1556.007 Hybrid Identity sub-technique
- T1649 Steal or Forge Authentication Certificates technique
- T1556.006 Multi-Factor Authentication sub-technique
- T1621 Multi-Factor Authentication Request Generation technique
- T1557.003 DHCP Spoofing sub-technique
- T1556.005 Reversible Encryption sub-technique
- T1552.007 Container API sub-technique
- T1555.005 Password Managers sub-technique
- T1606 Forge Web Credentials technique
- T1606.001 Web Cookies sub-technique
- T1606.002 SAML Tokens sub-technique
- T1555.004 Windows Credential Manager sub-technique
- T1556.004 Network Device Authentication sub-technique
- T1557.002 ARP Cache Poisoning sub-technique
- T1558.004 AS-REP Roasting sub-technique
- T1556.003 Pluggable Authentication Modules sub-technique
- T1003.004 LSA Secrets sub-technique
- T1003.005 Cached Domain Credentials sub-technique
- T1555.001 Keychain sub-technique
- T1555.002 Securityd Memory sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1003.001 LSASS Memory sub-technique
- T1003.002 Security Account Manager sub-technique