Techniques › T1212
T1212 Exploitation for Credential Access
credential access — Linux, Windows, macOS, Identity Provider · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
5
Sigma rules tagged attack.t1212
4
KEV CVEs mapped here
<p>Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.</p><p>Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is
MS14-068, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges.</p><p>Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal.</p><p>Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-48928 | TeleMessage TM SGNL | exploitation technique | Mapped | 2025-07-01 |
| CVE-2025-48927 | TeleMessage TM SGNL | exploitation technique | Mapped | 2025-07-01 |
| CVE-2024-53704 | SonicWall SonicOS | exploitation technique | Mapped | 2025-02-18 |
| CVE-2022-22948 | VMware vCenter Server | primary impact | Mapped | 2024-07-17 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0174 Detection Strategy for Exploitation for Credential Access v1.0
AN0493 WindowsDetects adversary exploitation of authentication mechanisms or credential validation processes. Defender perspective includes forged Kerberos tickets (e.g., MS14-068), abnormal LSASS memory access, replayed authentication attempts, and unexpected crashes of authentication services. Multi-event correlation ties exploitation attempts to abnormal process creation, service instability, and suspicious authentication events.Tunable:
MonitoredAccountsReplayDetectionWindowAN0494 LinuxDetects exploitation of authentication daemons or PAM modules. Defender perspective includes failed or anomalous PAM authentications, abnormal segfaults in authentication services, and exploitation attempts followed by successful unauthorized logins. Correlation identifies memory corruption, replay attempts, and privilege escalation tied to credential services.auditd:SYSCALLexecve: Suspicious binaries or scripts interacting with authentication binaries (sshd, gdm, login)→ DC0032 Process CreationNSM:ConnectionsRepeated failed authentication attempts or replay patterns→ DC0002 User Account AuthenticationTunable:AuthServiceListFailureThresholdAN0495 macOSDetects exploitation attempts against macOS authentication frameworks such as OpenDirectory or Keychain. Defender perspective includes abnormal crashes in opendirectoryd, unauthorized Keychain API usage, and unusual sudo or login events. Correlation links unexpected process behavior with credential access anomalies.macos:unifiedlogopendirectoryd crashes or abnormal authentication errors→ DC0038 Application Log Contentmacos:osqueryexecve: Processes unexpectedly invoking Keychain or authentication APIs→ DC0032 Process CreationTunable:WatchedAPIsCrashCorrelationWindowAN0496 Identity ProviderDetects exploitation of vulnerabilities in cloud identity providers (IdPs) such as Azure AD or Okta for credential access. Defender perspective includes anomalous token creation or renewal, authentication bypass events, and API abuse to mint unauthorized tokens. Correlation highlights exploitation attempts tied to absent or inconsistent audit logs.azure:signinlogsTokenIssued, TokenRenewed: Unexpected or anomalous token issuance events→ DC0002 User Account Authenticationm365:unifiedConsentGranted: Abuse of application integrations to mint tokens bypassing MFA→ DC0038 Application Log ContentTunable:TokenAnomalyThresholdMonitoredAppIntegrations
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1212
Author: Florian Roth (Nextron Systems)
· 2020-07-03 (modified 2021-11-27) · logsource: product=linux service=guacamole · 1edd77db-0669-4fef-9598-165bda82826d
Detects suspicious session with two users present
Author: Tim Burrell
· 2020-02-07 (modified 2024-11-23) · logsource: product=windows category=process_creation · 440a56bf-7873-4439-940a-1c8a671073c2
Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Elastic (idea), Tobias Michalski (Nextron Systems)
· 2022-05-04 (modified 2023-02-09) · logsource: product=windows category=process_creation · bb76d96b-821c-47cf-944b-7ce377864492
Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service
Author: Florian Roth (Nextron Systems)
· 2017-02-10 (modified 2024-01-16) · logsource: product=windows service=security · f7644214-0eb0-4ace-9455-331ec4c09253
Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.