Credential Access : A beginner Friendly guide in MITRE framework

CyberDefender 7 mins0

Credential Access is the MITRE ATT&CK tactic that encompasses adversary techniques designed to steal, brute-force, intercept, dump, forge, or otherwise acquire authentication material such as passwords, hashes, Kerberos tickets, OAuth tokens, SSH keys, cloud credentials, and password managers’ artifacts.

Credential Access is one of the most critical tactics because any elevation in authentication capabilities drastically accelerates lateral movement, privilege escalation, and persistence across both on-prem and cloud infrastructures.

How Credential Access Fits Into MITRE Mapping

When performing MITRE mapping during detection engineering, threat modeling, red-teaming, or IR, Credential Access is typically inserted after Initial Access (TA0001) and Execution (TA0002) and before tactics such as Privilege Escalation (TA0004) and Lateral Movement (TA0008).

A standard attack chain:

  1. Initial Access (e.g., phishing → user execution)
  2. Execution
  3. Persistence
  4. Privilege Escalation
  5. Credential Access (TA0006)
  6. Discovery
  7. Lateral Movement
  8. Collection → Exfiltration → Impact

Hence, all discovered technique IDs under TA0006 help analysts understand exactly which credential artifacts were targeted and how.

🧪 Technical Breakdown of TA0006 Techniques 

Below is a technical walk-through of the major techniques and sub-techniques with explanations of how they map to events, logs, and attacker behaviors.

T1003 – OS Credential Dumping

The most prevalent technique where adversaries extract credentials directly from the OS. Sub-techniques include:

T1003.001 – LSASS Memory

Dumping LSASS via:

  • comsvcs.dll → MiniDump export
  • rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump
  • Direct syscalls to avoid EDR DLL hooks
  • procdump64.exe -ma lsass.exe

Telemetry Mappings:

  • Sysmon Event ID 10 (Process Access: LSASS)
  • Windows Security 4656 / 4663 (Handle access attempts)
  • ETW → Microsoft-Windows-Security-Auditing

EDR Indicators:

  • Access rights PROCESS_VM_READ or PROCESS_DUP_HANDLE to LSASS
  • Non-Microsoft signed binaries touching LSASS

T1003.002 – Security Account Manager (SAM)

Typical methods:

  • reg save HKLM\SAM
  • Offline extraction via Volume Shadow Copy (vssadmin create shadow)

Mapping Notes:

  • Windows Event ID 4657 (registry value change)
  • 4663 for file access to C:\Windows\System32\config\SAM

T1003.003 – NTDS.dit Dumping

Domain controller credential extraction:

  • ntdsutil "activate instance ntds" "ifm"
  • esentutl /y /vss

Detection:

  • Directory Service logs (DS Access 4662)
  • Abnormal shadow copy creations
  • Suspicious SMB reads targeting ntds.dit

T1003.004 – LSA Secrets

LSA secrets including service account passwords:

  • Registry hive dump of HKLM\SECURITY\Policy\Secrets

T1003.006 – DCSync

Abuse of DsGetNCChanges() to request replication of password hashes.

Forensic Indicators:

  • Security 4662 with Replicating Directory Changes All
  • Modifications to ACL rights in AD

T1555 – Credentials from Password Stores

Covers credential extraction from:

T1555.003 – Credentials from Web Browsers

  • Chrome’s Login Data SQLite DB
  • DPAPI decryption using user master key (AppData\Roaming\Microsoft\Protect)

T1555.005 – Password Managers

Attacker accesses KeePass DB (.kdbx) and memory artifacts:

  • Memory scraping for master password
  • Plugin injection

T1557 – Man-in-the-Middle (Network-Based Credential Interception)

Intercepting authentication data via:

T1557.001 – LLMNR/NBNS Poisoning

Tools: Responder, Inveigh
Targets NTLM challenge/response.

Artifacts:

  • Network traffic containing NBNS queries
  • LLMNR unsolicited responses

T1557.002 – ARP Spoofing

Used for credential interception on flat networks.

T1110 – Brute Force

Automated guessing of passwords.

T1110.003 – Password Spraying

Avoids account lockouts by rotating accounts rather than repeatedly guessing one.

Detection Mapping:

  • Event ID 4625 failures across many accounts from one source IP
  • Azure AD Sign-in logs: error code 50053

T1558 – Steal or Forge Kerberos Tickets

Critical for domain environments.

T1558.001 – Golden Ticket

Attackers forge TGTs using:

  • KRBTGT hash
  • Mimikatz kerberos::golden

T1558.002 – Silver Ticket

Forged TGS using service account NTLM hash.

T1558.003 – Kerberoasting

Extract service account tickets via:

  • GetUserSPNs.py
  • Rubeus.exe kerberoast

Indicators:

  • High volume of TGS-REQ (Event 4769)
  • RC4 encryption tickets requested for SPNs (suspicious)

T1552 – Unsecured Credentials

Locating plaintext or recoverable credentials in:

  • Config files (web.config, .env, kube manifests)
  • Scripts
  • Windows Credential Manager
  • Cached cloud tokens (AWS, GCP, Azure CLI)

T1040 – Network Sniffing

Capturing traffic using raw sockets or promiscuous NIC:

  • tcpdump, WinPcap, Npcap
  • Custom NDIS filter drivers to evade EDR

T1528 – Domain Controller Authentication Abuse

Cloud-identity-focused credential harvesting:

  • OAuth token interception
  • Refresh token theft
  • IMDSv1 SSRF abuse (Azure/AWS metadata)

🧷 How To Map These Techniques in MITRE ATT&CK Matrices

When mapping an event, detection, or IR artifact:

  1. Identify the adversary behavior
    Example: “Attacker requested TGS tickets repeatedly for multiple SPNs.”

  2. Map to the closest MITRE technique/sub-technique
    → T1558.003 – Kerberoasting

  3. Map detection logic to data sources

    • Event logs: Windows 4769

    • Network logs: Kerberos TGS traffic anomalies

  4. Document detection analytics
    Example:

    rule: Detect Kerberoasting
    condition: (EventID = 4769) AND (TicketEncryptionType = 0x17)
    AND (ServiceName NOT IN baseline)

  5. Tie to attacker tradecraft & toolsets
    Example tools: Rubeus, Impacket

  6. Map mitigations

    • Enforce AES-only Kerberos

    • Rotate service account passwords frequently

CyberDefender