Stolen credentials let an attacker stop looking like an attacker, and the Credential Access tactic (TA0006) in MITRE ATT&CK covers every way they get them. ATT&CK v20 describes the tactic as the adversary "trying to steal account names and passwords", but its 18 techniques reach well beyond passwords: Kerberos tickets, session cookies, OAuth tokens, certificates, cloud secrets and the instance metadata service all appear. This page is the hub for that tactic. It groups the techniques by what is stolen, shows the v20 detection strategies and log sources that catch them, and sets out the hardening that removes whole technique families. It links out to the deeper technique guides rather than repeating them, and is written for SOC analysts, identity engineers and detection teams.
Key takeaways
- Credential Access is an identity problem with an endpoint component. Half of the techniques target identity systems directly (Kerberos, MFA, SSO tokens, certificates, cloud secrets) rather than the host.
- Keylogging and browser stores dominate the procedure data. In the v20 dataset Keylogging (T1056.001) has 155 recorded uses, Credentials from Web Browsers (T1555.003) 93 and LSASS Memory (T1003.001) 79.
- Machine credentials are first-class targets. T1552 Unsecured Credentials, T1555.006 Cloud Secrets Management Stores, T1552.005 Cloud Instance Metadata API and T1528 Steal Application Access Token are about non-human identities.
- Platform controls remove whole families. Credential Guard, LSA protection, phishing-resistant MFA and short-lived tokens defeat techniques that detection alone only spots after the fact.
- Assume theft and shorten the value. Rotation, token binding, conditional access and fast revocation limit what a stolen secret is worth.
How the attack works
Credential theft usually follows execution and often precedes lateral movement and privilege escalation. The adversary harvests whatever material is reachable from the current foothold, then uses it through T1078 Valid Accounts or T1550 Use Alternate Authentication Material. The 18 techniques fall into five groups.
| What is stolen | ATT&CK v20 techniques | Typical location |
|---|---|---|
| Secrets in OS memory and stores | T1003 OS Credential Dumping (LSASS Memory, SAM, NTDS, LSA Secrets, Cached Domain Credentials, DCSync, Proc Filesystem, /etc/passwd and /etc/shadow), T1555 Credentials from Password Stores (Keychain, web browsers, Windows Credential Manager, password managers, cloud secrets stores) | Endpoints, servers, domain controllers, secrets vaults |
| Secrets left lying around | T1552 Unsecured Credentials (files, registry, shell history, private keys, cloud instance metadata API, Group Policy Preferences, container API, chat messages) | Code, scripts, config files, CI variables, chat |
| Passwords captured or guessed | T1056 Input Capture, T1110 Brute Force (guessing, cracking, spraying, stuffing), T1040 Network Sniffing, T1557 Adversary-in-the-Middle, T1187 Forced Authentication | User sessions, login portals, network traffic |
| Authentication material and protocols | T1558 Steal or Forge Kerberos Tickets (Golden Ticket, Silver Ticket, Kerberoasting, AS-REP Roasting, Ccache Files), T1649 Steal or Forge Authentication Certificates, T1606 Forge Web Credentials, T1556 Modify Authentication Process | Active Directory, AD CS, federation and IdP configuration |
| Sessions, tokens and MFA | T1539 Steal Web Session Cookie, T1528 Steal Application Access Token, T1111 Multi-Factor Authentication Interception, T1621 Multi-Factor Authentication Request Generation, T1697 Steal Application Specific Passwords, T1212 Exploitation for Credential Access | Browsers, OAuth consent flows, MFA push services, SaaS |
For the detail on each family use the technique guides: the Credential Dumping Guide, MITRE ATT&CK T1552 Unsecured Credentials Guide, T1555 Credentials from Password Stores Defensive Guide, MITRE ATT&CK T1528 Steal Application Access Token Guide, MITRE ATT&CK T1556 Modify Authentication Process Guide and MITRE ATT&CK T1606 Forge Web Credentials Guide.
Where it shows up
- Infostealers on unmanaged devices: malware on personal or contractor machines harvests browser passwords and cookies (T1555.003, T1539), which are sold and reused against corporate SaaS. See the Infostealer Threat Guide.
- Active Directory intrusions: LSASS dumping, Kerberoasting of service accounts with weak passwords, DCSync and NTDS extraction once domain admin is reached. See the Kerberos Security Guide.
- Identity provider attacks: password spraying against cloud sign-in, MFA push bombing and adversary-in-the-middle phishing kits that capture session cookies after MFA. See the MFA Fatigue and Bypass Guide.
- Cloud and DevOps: access keys in repositories and CI logs, secrets bulk-read from AWS Secrets Manager or Azure Key Vault, and role credentials taken from the instance metadata service through a server-side request forgery.
- Certificate services: misconfigured AD CS templates let a low-privileged user request a certificate that authenticates as someone else (T1649). See the AD CS Security Guide.
Impact
Valid credentials convert a noisy intrusion into authorised activity. With them the adversary can sign in over VPN and SaaS without malware, move laterally with administrative rights, persist after the original foothold is cleaned, and reach data and backups. Credentials from domain controllers (NTDS, the KRBTGT key) or federation signing keys compromise every account in the domain or tenant, and recovery means resetting secrets at scale. Stolen machine credentials are especially durable: API keys and service account passwords are often unrotated for years, so one leak can stay usable long after the incident.
Detection
Each v20 technique carries a detection strategy with platform analytics. The most useful for this tactic are summarised below.
| Technique | v20 detection strategy | Log sources named in the analytics | Signal |
|---|---|---|---|
| T1003 OS Credential Dumping | DET0234 | Sysmon Event ID 10 (process access), Sysmon Event ID 1, Security Event IDs 4656, 4663, 4670; auditd ptrace and /proc/*/mem | Non-security processes opening LSASS or SAM hives; memory reads of sshd or login on Linux |
| T1110 Brute Force | DET0463 | Security Event IDs 4625 and 4776, Entra ID sign-in logs, Microsoft 365 unified audit log, auditd USER_AUTH | Many failures across many users from one source (spraying), or failures followed by a success |
| T1558 Kerberos tickets | DET0522 | Security Event IDs 4672 and 4634, Sysmon Event ID 10; SSSD secrets access on Linux | RC4-encrypted tickets, service ticket requests with no matching TGT request, LSASS access for ticket export |
| T1555 Password stores | DET0430 | Sysmon Event IDs 1 and 10, Security Event ID 4663, CloudTrail GetSecretValue and Decrypt | Unexpected processes reading browser credential databases or Credential Manager; bulk secret retrieval in the cloud |
| T1539 Session cookies | DET0509 | Sysmon Event ID 10, Okta session.token.reuse, Google Workspace login events | Access to browser cookie databases by non-browser processes; session reuse from a new user agent or location |
| T1621 MFA request generation | DET0160 | Entra ID sign-in logs, Okta MFAChallengeIssued, CloudTrail ConsoleLogin | Repeated push challenges for one user with denials or timeouts, then an approval |
Additional analytics worth building
- Kerberoasting: Security Event ID 4769 service ticket requests with encryption type 0x17 (RC4) for accounts with SPNs, especially many SPNs requested by one user in a short window.
- DCSync: directory replication requests (Event ID 4662 with replication rights) from hosts that are not domain controllers.
- Honey credentials: decoy accounts and fake keys planted in scripts or memory, alerting on any use (D3FEND D3-DUC Decoy User Credential).
- Secrets in code: secret scanning on commits, CI logs and ticket systems, treating every hit as a potential exposure.
Metrics that show it is working
- Protection coverage: percentage of Windows endpoints with Credential Guard and LSA protection running (WinInit Event ID 12 confirms LSASS started as a protected process).
- Phishing-resistant MFA coverage: share of workforce and administrator sign-ins using FIDO2 or certificate-based authentication.
- Service account hygiene: count of SPN accounts with RC4 enabled or passwords older than 12 months.
- Secret exposure dwell time: median time from a detected leaked secret to its revocation.
- Detection test pass rate: share of credential access atomic tests that raise an alert within 15 minutes.
Prevention and hardening
| Control | Techniques defeated or reduced | Implementation notes |
|---|---|---|
| Credential Guard (M1043) | T1003.001, T1558 ticket theft, pass the hash and pass the ticket | Uses virtualisation-based security to isolate NTLM hashes, Kerberos TGTs and stored domain credentials; on by default from Windows 11 22H2 on domain-joined, non-DC Enterprise and Education devices that meet the requirements. Does not protect the AD database or SAM. |
| LSA protection (M1025) | T1003.001, T1556.002 password filter DLLs | RunAsPPL registry value or the "Configures LSASS to run as a protected process" policy; audit first using CodeIntegrity Event IDs 3065 and 3066 to find plug-ins that would fail |
| Phishing-resistant MFA (M1032) | T1110, T1111, T1621, T1557 credential phishing | FIDO2 or passkeys for administrators first; number matching where push remains. See the Phishing-Resistant MFA Guide. |
| Kerberos and AD hygiene (M1015, M1027) | T1558.003, T1558.004, T1003.006 | Group managed service accounts with long random passwords, AES only, remove "do not require Kerberos preauthentication", restrict replication rights. See the Group Managed Service Accounts (gMSA) Guide. |
| Local admin password uniqueness | Reuse of SAM hashes for lateral movement | See the Local Administrator Password Solution (LAPS) Guide. |
| Secrets management (M1041) | T1552, T1555.006 | Vaulted, short-lived secrets; workload identity federation in place of static keys; IMDSv2 on AWS. See the Secrets Management Guide. |
| Session protection | T1539, T1528 | Short session lifetimes for privileged apps, token protection or binding where the IdP supports it, compliant-device conditional access, admin consent for OAuth apps |
Phased rollout
- Inventory: list privileged accounts, service accounts with SPNs, cloud access keys and where secrets live in code and pipelines.
- Audit mode: enable LSA protection audit and the attack surface reduction rule "Block credential stealing from the Windows local security authority subsystem" in audit; review CodeIntegrity and ASR events with application owners.
- Pilot: enforce Credential Guard, LSA protection and phishing-resistant MFA on IT and administrator devices first.
- Broad enforcement: extend in rings; convert service accounts to gMSA, rotate KRBTGT twice on a planned schedule, replace static cloud keys.
- Rollback: keep a tested path to disable each control for one ring (Credential Guard default enablement is applied without UEFI lock, so it can be turned off remotely; a UEFI-locked LSA protection setting cannot be reverted by registry). Choose the lock deliberately.
Decision guidance
- Prevention versus detection: invest in prevention first for credential dumping and phishing (Credential Guard, FIDO2), because by the time dumping is detected the secrets may already be gone.
- Small organisations: cloud identity with phishing-resistant MFA, LAPS and a password manager cover most of the risk with little infrastructure.
- Large organisations: prioritise tier 0 (domain controllers, AD CS, federation servers, IdP admin roles) and the non-human identities that hold standing access.
Framework mapping
| Framework | Relevant references |
|---|---|
| NIST CSF 2.0 | PR.AA-01, PR.AA-03, PR.DS-01, DE.CM-01, DE.CM-03 |
| NIST SP 800-53 Rev. 5 | IA-2(1), IA-5, IA-5(7) No Embedded Unencrypted Static Authenticators, AC-6, AC-7, SC-28, SI-4 |
| CIS Controls v8.1 | Control 5 Account Management, Control 6 Access Control Management, Control 8 Audit Log Management |
| MITRE D3FEND | D3-CH Credential Hardening, D3-CRO Credential Rotation, D3-CR Credential Revocation, D3-DUC Decoy User Credential, D3-ANET Authentication Event Thresholding |
Lessons from incidents
- Infostealer credentials without MFA: in the Snowflake customer breaches (2024), Mandiant found at least 79.7 per cent of the accounts used had prior exposure in infostealer logs, some from infections dating to 2020; the accounts had no MFA, credentials had not been rotated and there were no network allow lists. About 165 organisations were notified.
- Synced browser passwords and push fatigue: in the Cisco breach (May 2022), a corporate password saved in a browser and synced to a personal Google account was taken over, then repeated vishing calls and MFA pushes produced an approval. The attacker enrolled new MFA devices and later attempted to dump NTDS.
Common failure patterns
- MFA everywhere except where it matters: legacy protocols, service accounts and data platforms left on single-factor authentication.
- Push MFA without number matching: fatigue attacks only need one tired approval.
- Kerberoastable service accounts: human-chosen passwords on accounts with SPNs, still accepting RC4.
- Personal browser sync on corporate credentials: credentials leave managed control entirely.
- Revocation that misses tokens: resetting a password while refresh tokens, sessions and API keys stay valid.
Practitioner checklist
- Confirm Credential Guard and LSA protection are running across the Windows fleet and track exceptions.
- Alert on non-standard processes accessing LSASS (Sysmon Event ID 10) and on DCSync from non-DC hosts.
- Hunt for RC4 service tickets (Event ID 4769, type 0x17) and move SPN accounts to gMSA with AES.
- Roll out phishing-resistant MFA to administrators, then all staff; enable number matching for remaining push.
- Block corporate credential sync to personal browser profiles and limit access from unmanaged devices.
- Scan code, CI logs and chat for secrets and revoke every exposed secret, not just delete it.
- Replace static cloud keys with workload identity and alert on bulk GetSecretValue calls.
- Plant decoy credentials and alert on any use.
- Include token and session revocation in the credential compromise playbook.
Standards and references
- MITRE ATT&CK: Credential Access (TA0006)
- MITRE ATT&CK: OS Credential Dumping (T1003)
- MITRE ATT&CK: Steal or Forge Kerberos Tickets (T1558)
- Microsoft Learn: Credential Guard overview
- Microsoft Learn: Configure added LSA protection
- Microsoft Learn: Attack surface reduction rules reference
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Credential Dumping Guide · MITRE ATT&CK T1078 Valid Accounts Guide · Session Hijacking and Cookie Theft Guide · Password Spraying and Credential Stuffing Defence Guide · ATT&CK Execution Tactic Guide