TA0006 / Enterprise tactic
Credential Access
Official MITRE tacticThe adversary is trying to steal account names and passwords.
Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
18 techniques
- T1557Adversary-in-the-Middle4 sub-techniques
- T1110Brute Force4 sub-techniques
- T1555Credentials from Password Stores6 sub-techniques
- T1212Exploitation for Credential Access
- T1187Forced Authentication
- T1606Forge Web Credentials2 sub-techniques
- T1056Input Capture4 sub-techniques
- T1556Modify Authentication Process9 sub-techniques
- T1111Multi-Factor Authentication Interception
- T1621Multi-Factor Authentication Request Generation
- T1040Network Sniffing
- T1003OS Credential Dumping8 sub-techniques
- T1528Steal Application Access Token
- T1697Steal Application Specific Passwords
- T1649Steal or Forge Authentication Certificates
- T1558Steal or Forge Kerberos Tickets5 sub-techniques
- T1539Steal Web Session Cookie
- T1552Unsecured Credentials8 sub-techniques