Cyber Wiki Learning Path
MITRE ATT&CK®: Credential Access
Explore all active Enterprise ATT&CK v19.2 techniques and sub-techniques associated with the Credential Access objective, with defensive explanations and linked BMC learning resources.
Recommended Sequence
67 connected entries
/etc/passwd and /etc/shadow (T1003.008)
/etc/passwd and /etc/shadow (T1003.008) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedARP Cache Poisoning (T1557.002)
ARP Cache Poisoning (T1557.002) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
ATT&CK sub-technique profile · AdvancedAS-REP Roasting (T1558.004)
AS-REP Roasting (T1558.004) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK technique profile · IntermediateAdversary-in-the-Middle (T1557)
Adversary-in-the-Middle (T1557) is an Enterprise ATT&CK technique associated with Credential Access, Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateBrute Force (T1110)
An adversary repeatedly attempts passwords, keys, or authentication combinations, including guessing, spraying, cracking, and credential stuffing.
ATT&CK sub-technique profile · AdvancedCached Domain Credentials (T1003.005)
Cached Domain Credentials (T1003.005) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedCcache Files (T1558.005)
Ccache Files (T1558.005) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedChat Messages (T1552.008)
Chat Messages (T1552.008) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedCloud Instance Metadata API (T1552.005)
Cloud Instance Metadata API (T1552.005) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedCloud Secrets Management Stores (T1555.006)
Cloud Secrets Management Stores (T1555.006) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedConditional Access Policies (T1556.009)
Conditional Access Policies (T1556.009) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedContainer API (T1552.007)
Container API (T1552.007) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedCredential API Hooking (T1056.004)
Credential API Hooking (T1056.004) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
ATT&CK sub-technique profile · AdvancedCredential Stuffing (T1110.004)
Credential Stuffing (T1110.004) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedCredentials In Files (T1552.001)
Credentials In Files (T1552.001) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK technique profile · IntermediateCredentials from Password Stores (T1555)
An adversary extracts credentials, keys, cookies, or tokens from browsers, password managers, operating-system stores, or application repositories.
ATT&CK sub-technique profile · AdvancedCredentials from Web Browsers (T1555.003)
Credentials from Web Browsers (T1555.003) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedCredentials in Registry (T1552.002)
Credentials in Registry (T1552.002) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedDCSync (T1003.006)
DCSync (T1003.006) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedDHCP Spoofing (T1557.003)
DHCP Spoofing (T1557.003) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
ATT&CK sub-technique profile · AdvancedDomain Controller Authentication (T1556.001)
Domain Controller Authentication (T1556.001) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedEvil Twin (T1557.004)
Evil Twin (T1557.004) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
ATT&CK technique profile · IntermediateExploitation for Credential Access (T1212)
Exploitation for Credential Access (T1212) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateForced Authentication (T1187)
Forced Authentication (T1187) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateForge Web Credentials (T1606)
Forge Web Credentials (T1606) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedGUI Input Capture (T1056.002)
GUI Input Capture (T1056.002) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
ATT&CK sub-technique profile · AdvancedGolden Ticket (T1558.001)
Golden Ticket (T1558.001) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedGroup Policy Preferences (T1552.006)
Group Policy Preferences (T1552.006) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedHybrid Identity (T1556.007)
Hybrid Identity (T1556.007) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK technique profile · IntermediateInput Capture (T1056)
Input Capture (T1056) is an Enterprise ATT&CK technique associated with Collection, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedKerberoasting (T1558.003)
Kerberoasting (T1558.003) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedKeychain (T1555.001)
Keychain (T1555.001) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedKeylogging (T1056.001)
Keylogging (T1056.001) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
ATT&CK sub-technique profile · AdvancedLSA Secrets (T1003.004)
LSA Secrets (T1003.004) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedLSASS Memory (T1003.001)
LSASS Memory (T1003.001) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK technique profile · IntermediateModify Authentication Process (T1556)
Modify Authentication Process (T1556) is an Enterprise ATT&CK technique associated with Defense Impairment, Persistence, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedMulti-Factor Authentication (T1556.006)
Multi-Factor Authentication (T1556.006) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK technique profile · IntermediateMulti-Factor Authentication Interception (T1111)
Multi-Factor Authentication Interception (T1111) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateMulti-Factor Authentication Request Generation (T1621)
Multi-Factor Authentication Request Generation (T1621) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedNTDS (T1003.003)
NTDS (T1003.003) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedName Resolution Poisoning and SMB Relay (T1557.001)
Name Resolution Poisoning and SMB Relay (T1557.001) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
ATT&CK sub-technique profile · AdvancedNetwork Device Authentication (T1556.004)
Network Device Authentication (T1556.004) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedNetwork Provider DLL (T1556.008)
Network Provider DLL (T1556.008) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK technique profile · IntermediateNetwork Sniffing (T1040)
Network Sniffing (T1040) is an Enterprise ATT&CK technique associated with Credential Access, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateOS Credential Dumping (T1003)
An adversary reads operating-system memory, databases, caches, registry material, or directory replication data to obtain credential artifacts.
ATT&CK sub-technique profile · AdvancedPassword Cracking (T1110.002)
Password Cracking (T1110.002) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedPassword Filter DLL (T1556.002)
Password Filter DLL (T1556.002) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedPassword Guessing (T1110.001)
Password Guessing (T1110.001) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedPassword Managers (T1555.005)
Password Managers (T1555.005) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedPassword Spraying (T1110.003)
Password Spraying (T1110.003) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedPluggable Authentication Modules (T1556.003)
Pluggable Authentication Modules (T1556.003) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedPrivate Keys (T1552.004)
Private Keys (T1552.004) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedProc Filesystem (T1003.007)
Proc Filesystem (T1003.007) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedReversible Encryption (T1556.005)
Reversible Encryption (T1556.005) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedSAML Tokens (T1606.002)
SAML Tokens (T1606.002) is an Enterprise ATT&CK sub-technique under Forge Web Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedSecurity Account Manager (T1003.002)
Security Account Manager (T1003.002) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedSecurityd Memory (T1555.002)
Securityd Memory (T1555.002) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedShell History (T1552.003)
Shell History (T1552.003) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedSilver Ticket (T1558.002)
Silver Ticket (T1558.002) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK technique profile · IntermediateSteal Application Access Token (T1528)
Steal Application Access Token (T1528) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateSteal Web Session Cookie (T1539)
Steal Web Session Cookie (T1539) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateSteal or Forge Authentication Certificates (T1649)
Steal or Forge Authentication Certificates (T1649) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateSteal or Forge Kerberos Tickets (T1558)
Steal or Forge Kerberos Tickets (T1558) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateUnsecured Credentials (T1552)
An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.
ATT&CK sub-technique profile · AdvancedWeb Cookies (T1606.001)
Web Cookies (T1606.001) is an Enterprise ATT&CK sub-technique under Forge Web Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
ATT&CK sub-technique profile · AdvancedWeb Portal Capture (T1056.003)
Web Portal Capture (T1056.003) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
ATT&CK sub-technique profile · AdvancedWindows Credential Manager (T1555.004)
Windows Credential Manager (T1555.004) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.