VOID MANTICOREG1055 ↗
Has utilized credential stuffing attacks to obtain initial access to victim environments.1
- Tactic
- Credential Access
- Platforms
- Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
- Version
- 1.7
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributors
- Diogo Fernandes; Anastasios Pingios
Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.12
Detection rulesTop 21%
Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.Credential Stuffing MITRE reference T1110.004
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
ChimeraG0114 ↗
Has used credential stuffing against victim's remote services to obtain valid accounts.1
All 2 groups for this technique
Offense vs defense T1110.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 12
first rule: 2022 Q3Credential Stuffing detection strategy DET0460
MITRE names one behaviour worth catching for this technique and breaks it into 9 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Credential Stuffing Detection via Reused Breached Credentials Across Services
9 platforms
AN1262 · Windows
Multiple failed authentication attempts using distinct username/password pairs from a single IP address or session within a short time window, targeting common services like RDP or SMB
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | WinEventLog:Security | EventCode=4625 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UsernameUniquenessThreshold | Minimum number of unique usernames in failed login attempts before triggering alert |
| TimeWindow | Duration (e.g., 5 minutes) to observe the behavior chain of rapid login attempts |
| SourceIPScope | Whether to group by full IP or CIDR block for bursty behavior from botnets |
AN1263 · Linux
Rapid login failures across different users from a single IP address, targeting SSH or PAM login with distinct username-password pairs
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | linux:syslog | SSH failed login |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| LoginFailureRatio | Ratio of failed logins per unique user attempted |
| AuthServiceFilter | Restrict detection to certain protocols (e.g., sshd, login, su) |
AN1264 · macOS
Burst of failed authentications with rotating usernames against loginwindow or remote management service using reused breached credentials
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | macos:unifiedlog | Login failure / authorization denied |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DistinctUsernameCount | Tunable threshold for number of attempted usernames in a time window |
| RemoteAccessFilter | Restrict behavior detection to remote login interfaces |
AN1265 · Identity Provider
Same source IP performing multiple authentication attempts using known breached username/password combinations across different identities in Azure AD, Okta, or Duo
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | azure:signinlogs | status = failure |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BreachedCredentialSourceMatch | Optional enrichment using known leaked credentials database |
| SSOServiceScope | Targeting only federated or hybrid identity auth flows |
AN1266 · SaaS
Multiple sign-in failures against cloud-based applications using username/password combinations leaked from unrelated domains
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | saas-app:auth | login_failure |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserAccountOverlap | Correlate credentials reused across multiple SaaS platforms |
| FailedAttemptsPerIP | Number of failed logins from same IP before alerting |
AN1267 · Network Devices
Router/firewall/syslog logs showing authentication failures with unique usernames and reused credentials from same source IP
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | networkdevice:syslog | AAA, RADIUS, or TACACS authentication |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthProtocolFilter | Limit detection to interactive logins rather than SNMP/RPC |
| FailedAuthBurst | Detection trigger when failure rate exceeds normal profile |
AN1268 · Containers
Credential stuffing attempts against Kubernetes API or containerized login shells using stolen or leaked user credentials
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | kubernetes:apiserver | authentication.k8s.io/v1beta1 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PodAccessScope | Detect attempts across multiple pods/namespaces using same IP |
| CredentialSetSize | Number of username/password pairs used in attack attempt |
AN1269 · Office Suite
Use of leaked credential pairs against Outlook Web Access (OWA), Microsoft 365, or Exchange from a single client IP with multiple failures
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | m365:exchange | Logon failure |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PasswordSourceMatch | Optional: cross-reference to haveibeenpwned or internal credential dumps |
| MailboxLoginThreshold | Tunable value for how many unique mailbox attempts trigger alert |
AN1270 · IaaS
Burst of failed login attempts across VM instances using leaked credential pairs from single IP in public cloud environments
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | AWS:CloudTrail | eventName=ConsoleLogin | eventType=AwsConsoleSignIn |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| InstanceIDScope | Define if detection should group logins per host or across cluster |
| IPBehaviorHistory | Correlate against past IP reputation or behavioral profiles |
Account Use PoliciesM1036
Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges. Consider blocking risky authentication requests, such as those originating from anonymizing services/proxies.
Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
Password PoliciesM1027
Refer to NIST guidelines when creating password policies.
Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts.
Tests4Executorsbash 2 · sh 1 · PowerShell 1Need elevation0 of 4Have prerequisites4Have cleanup0Platformslinux, macos, windows
Tests from Atomic Red Team (MIT licence) · technique definition