When the software that issues, checks or stores credentials has a bug, an adversary can mint tickets, forge tokens or read secrets out of memory without ever guessing a password. MITRE ATT&CK records this as T1212 Exploitation for Credential Access in the Credential Access tactic (ATT&CK v20, platforms Windows, Linux, macOS and Identity Provider). The bug classes themselves are explained in the Memory Corruption Vulnerabilities Guide; this page is about the credential consequence. It covers which components are in scope, how to prioritise their patches, the v20 detection analytics, the platform protections that limit what a successful exploit yields, and the response step that is most often missed: rotating every credential the vulnerable component could have exposed. It is for vulnerability managers, identity engineers and SOC analysts, and contains no exploit detail.
Key takeaways
- Credential components are a patch class of their own. Domain controllers, Kerberos and Netlogon, identity providers, token services, VPN and SSO appliances, databases and secret stores deserve the shortest patch deadlines you have.
- Patching does not un-leak a secret. If a flaw could expose credentials, rotate everything the component held or handled during the exposure window.
- Validation logic is part of the attack surface. ATT&CK cites forged Kerberos tickets, replayed authentication and cloud token creation flaws; strict signature, issuer and audience checks remove whole families of bugs.
- Platform isolation limits the prize. Credential Guard and LSA protection keep NTLM hashes and Kerberos TGTs out of reach of many endpoint exploits.
- Detection looks for impossible credentials. DET0174 watches for anomalous ticket or token issuance, crashes of authentication services and unexpected LSASS access.
What T1212 covers in ATT&CK v20
ATT&CK describes adversaries exploiting software vulnerabilities to collect credentials or to circumvent authentication. Its examples are MS14-068, which let a domain user forge Kerberos tickets; replay attacks against services that do not properly validate authentication requests; and cloud flaws that allowed unintended token creation and renewal. It notes that exploitation for credential access may also achieve privilege escalation, depending on the process targeted.
| Attribute | ATT&CK v20 value | Defender implication |
|---|---|---|
| Technique | T1212 Exploitation for Credential Access | No sub-techniques |
| Tactic | Credential Access | Often chained with T1068 Exploitation for Privilege Escalation |
| Platforms | Windows, Linux, macOS, Identity Provider | Cloud identity services are in scope, not only on-premises software |
| Groups and campaigns | UNC3886; Leviathan Australian Intrusions | See the UNC3886 Threat Actor Profile Guide |
| Mitigations | M1013 Application Developer Guidance; M1019 Threat Intelligence Program; M1048 Application Isolation and Sandboxing; M1050 Exploit Protection; M1051 Update Software | Build, isolate, harden, patch and watch |
| Detection strategy | DET0174 Detection Strategy for Exploitation for Credential Access | Analytics AN0493 (Windows), AN0494 (Linux), AN0495 (macOS), AN0496 (Identity Provider) |
How T1212 differs from its neighbours
- T1190 Exploit Public-Facing Application: about getting in; T1212 is about getting credentials, whether the flaw is internet-facing or internal. See the T1190 Exploit Public-Facing Application Defensive Guide.
- T1068 Exploitation for Privilege Escalation: about raising rights on a host. See the T1068 Exploitation for Privilege Escalation.
- T1558 and T1606: forging Kerberos tickets or web credentials with stolen keys, no bug required. See the MITRE ATT&CK T1558 Steal or Forge Kerberos Tickets Guide and the MITRE ATT&CK T1606 Forge Web Credentials Guide.
Where credential-exposing flaws live
| Component class | What a flaw can yield | Illustrative case | Containment step after patching |
|---|---|---|---|
| Kerberos KDC and ticket validation | Forged tickets with elevated privileges | CVE-2014-6324 (MS14-068), KEV-listed, cited by ATT&CK | Review privileged ticket issuance for the exposure window; consider resetting the KRBTGT account per your AD recovery plan |
| Machine account and secure channel protocols | Takeover of a domain controller's credentials | CVE-2020-1472 (Netlogon), KEV-listed | Confirm enforcement mode; review machine account password changes |
| Memory disclosure in services | Passwords, keys and tokens from process memory | The MongoBleed breach, where an unauthenticated flaw returned heap memory that could hold credentials | Rotate every credential the service held or handled |
| Identity provider and token services | Tokens issued or renewed without valid authentication | ATT&CK cites a cloud flaw allowing unintended token creation and renewal | Revoke sessions and refresh tokens; review issuance logs |
| Authentication protocols without replay protection | Reuse of captured authentication messages | ATT&CK replay attack examples | Add nonces, timestamps or sequence numbers (M1013) |
| Endpoint credential stores (LSASS, keychains, PAM modules) | Hashes, tickets and cached secrets | DET0174 analytics for LSASS access and authentication daemon crashes | Reset credentials of every user who signed in to the host |
Patch prioritisation for credential components
A vulnerability in a component that issues or stores credentials has a blast radius well beyond the host, so it should outrank a flaw of the same CVSS score elsewhere. NHI Mgmt Group recommends a simple rule set:
- Tag credential components in the asset inventory: domain controllers, identity providers and federation servers, PAM and secrets platforms, certificate authorities, VPN and SSO gateways, databases holding application credentials, and CI/CD runners that hold deployment keys.
- Treat KEV listing as a deadline: any CISA KEV entry affecting a tagged component goes to emergency change. See the CISA KEV Catalogue Guide and the Emergency Out-of-Band Patching Playbook.
- Read the advisory for credential impact: if it mentions memory disclosure, authentication bypass, token or ticket forgery, or key exposure, plan rotation alongside the patch.
- Use vendor enforcement phases: some fixes ship in audit then enforcement phases. For CVE-2020-1472, Microsoft's initial deployment phase started on 11 August 2020 and the enforcement phase on 9 February 2021, with Netlogon events 5827 to 5831 recording denied or allowed vulnerable connections.
- Isolate what cannot be patched (M1048): restrict network reach to the management and authentication ports of unpatchable components and monitor them closely.
Decision guidance
- Patch now or patch and rotate: patch only when the flaw cannot expose secrets; patch and rotate when the advisory mentions memory, keys, tokens or authentication bypass, or when exploitation in the wild predates your patch.
- Rotate everything or a subset: rotate everything the component held if it was internet-reachable while vulnerable; for internal-only exposure, rotate privileged and non-human credentials first and the rest on normal schedule.
- Small organisations: rely on managed identity services and automatic updates for credential components, and keep a written list of secrets per service so rotation is possible at short notice.
- Large organisations: integrate threat intelligence (M1019) so advisories for tagged components page the identity team directly, not only the patch team.
Platform protections that limit the yield
| Protection | What it protects | Key settings and limits |
|---|---|---|
| Credential Guard | NTLM hashes, Kerberos TGTs and credentials stored by applications as domain credentials, isolated with virtualization-based security | Enabled by default on Windows 11 22H2 and Windows Server 2025 where requirements are met; does not protect the AD database or SAM; not recommended on domain controllers. See Credential Guard and VBS |
| LSA protection | LSASS memory against reads and code injection by non-protected processes | RunAsPPL under HKLM\SYSTEM\CurrentControlSet\Control\Lsa (1 with UEFI lock, 2 without); audit with CodeIntegrity events 3065 and 3066; verify with WinInit event 12 |
| Exploit protection (M1050) | Memory corruption exploitation in general | Process mitigations and control flow integrity; see the Exploit Mitigations Guide |
| Strict token validation (M1013) | Forged or replayed tokens | RFC 8725 practices: algorithm verification (3.1), validate all cryptographic operations (3.3), issuer and subject (3.8), audience (3.9), do not trust received claims (3.10); see the JWT Security Guide |
| Short-lived credentials | The value of anything leaked | Prefer workload identity and automatically rotated secrets for service-to-service access |
Detection
| Platform | ATT&CK v20 analytic focus (DET0174) | Telemetry | Tuning |
|---|---|---|---|
| Windows (AN0493) | Forged Kerberos tickets, abnormal LSASS memory access, replayed authentication, crashes of authentication services | Security Event IDs 4768, 4769 and 4770; Sysmon Event ID 10 | High-value accounts to watch; replay detection window |
| Linux (AN0494) | Anomalous PAM authentications, segfaults in authentication daemons, exploitation followed by unauthorised logins | auditd execve records for processes touching sshd, gdm or login; network connection data | Monitored services; failure threshold |
| macOS (AN0495) | opendirectoryd crashes, unauthorised Keychain API use, unusual sudo or login events | Unified log; osquery process events | Watched APIs; crash correlation window |
| Identity Provider (AN0496) | Anomalous token creation or renewal, authentication bypass events, API abuse to mint tokens, gaps in audit logs | Sign-in logs for token issue and renewal; unified audit for consent grants | Token anomaly threshold; privileged app integrations |
- Tickets that should not exist: service tickets for privileged groups without a matching TGT request, or tickets with lifetimes or encryption types outside policy. See the Kerberos Security Guide.
- Tokens without a sign-in: access tokens used for a user or application with no corresponding authentication event at the identity provider.
- Use after disclosure: logins with database or service credentials from new sources after a disclosure date, which the MongoBleed page also recommends watching.
- Service instability: repeated crashes of LSASS, sshd, opendirectoryd or an identity appliance process deserve a security look, not only a restart.
Metrics
- Median time to patch KEV-listed flaws on tagged credential components.
- Percentage of credential-exposure advisories closed with a completed rotation record.
- Percentage of eligible Windows endpoints with Credential Guard and LSA protection running.
- Number of credential components with no owner or no rotation runbook, target zero.
- Percentage of token-validating services tested against RFC 8725 checks.
Response runbook
- Bound the window: establish when the component became vulnerable, when exploitation was possible and when the patch landed.
- Patch or isolate: apply the fix or cut network reach to the component.
- Enumerate exposed credentials: list every password, key, token, certificate and ticket the component stored, issued or processed during the window, including non-human ones.
- Rotate in order: signing keys and privileged secrets first, then service credentials, then user sessions. Revoke refresh tokens and sessions issued in the window.
- Hunt for use: search for authentications with the exposed credentials from unfamiliar sources, before and after rotation.
- Record and review: note which credentials could not be rotated quickly and fix that before the next advisory.
Where identity fits
T1212 is where vulnerability management and identity security meet. The credentials most often exposed by these flaws are non-human: database connection strings, API keys, service account passwords and signing keys that live in the memory or configuration of the vulnerable component. Organisations that know which secrets each service holds, and can rotate them automatically, turn a credential-exposure advisory into a routine change. See the Signing keys and certificates in breaches guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SI-2 Flaw Remediation; RA-5 Vulnerability Monitoring and Scanning | Finding and fixing credential component flaws |
| NIST SP 800-53 Rev. 5 | SI-16 Memory Protection; IA-2(8) Replay Resistant; SC-23 Session Authenticity | Exploit mitigation, replay resistance, session integrity |
| NIST SP 800-53 Rev. 5 | IA-5 Authenticator Management; IR-4 Incident Handling | Rotation after exposure |
| NIST CSF 2.0 | ID.RA-01; PR.PS-02; DE.CM-09; RS.MI-01 | Vulnerability identification, software maintenance, monitoring, containment |
Common failure patterns
- Patch and forget: the vulnerable service is updated, but the keys and passwords it exposed stay valid for months.
- Credential components rated like any other server: a domain controller or identity appliance waits for the monthly cycle because its CVSS score was not the highest that month.
- Enforcement phases left in audit: exemptions granted during a compatibility phase are never removed.
- Home-grown token validation: services accept tokens without checking algorithm, issuer or audience, so a single signing or issuance bug has wide reach.
- Crashes treated as availability issues: repeated authentication service crashes are restarted without anyone asking why.
Practitioner checklist
- Tag every credential-issuing or credential-storing component in the asset inventory.
- Apply emergency patch deadlines to KEV entries affecting those components.
- Keep a list of secrets and keys per component so rotation can start within hours.
- Run Credential Guard and LSA protection on eligible Windows endpoints and verify they are active.
- Validate tokens per RFC 8725, including algorithm, issuer and audience checks.
- Deploy DET0174-style detections for anomalous tickets, tokens and authentication service crashes.
- Remove compatibility exemptions once enforcement phases are reached.
- Include rotation and token revocation in every credential-exposure response.
Standards and references
- MITRE ATT&CK: Exploitation for Credential Access (T1212)
- CISA: Known Exploited Vulnerabilities Catalog
- Microsoft Support: How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472
- Microsoft Learn: Credential Guard overview
- Microsoft Learn: Configure added LSA protection
- IETF: RFC 8725 JSON Web Token Best Current Practices
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Memory Corruption Vulnerabilities Guide · CISA KEV Catalogue Guide · Credential Guard and VBS · JWT Security Guide · UNC3886 Threat Actor Profile Guide