tfMITRE ATT&CK technique

Exploitation for Credential Access T1212

Tactic: Credential Access
Platforms: Linux, Windows, macOS, Identity Provider
Version: 1.6
Created: 18 April 2018
Last modified: 24 October 2025
Contributors: John Lambert, Microsoft Threat Intelligence Center; Mohit Rathore

Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules73rd pct

Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.

Exploitation for Credential Access MITRE reference T1212

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Exploited CVE-2022-22948 in VMware vCenter to obtain encrypted credentials from the vCenter postgresDB.1

created 2025-05-291 reference

All 1 groups for this technique

Offense vs defense T1212

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 3

first rule: 2017 Q1 · 1 of 1 campaigns plotted

Exploitation for Credential Access detection strategy DET0174

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Exploitation for Credential Access

Enterprise

4 platforms

AN0493 · Windows

Detects adversary exploitation of authentication mechanisms or credential validation processes. Defender perspective includes forged Kerberos tickets (e.g., MS14-068), abnormal LSASS memory access, replayed authentication attempts, and unexpected crashes of authentication services. Multi-event correlation ties exploitation attempts to abnormal process creation, service instability, and suspicious authentication events.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	WinEventLog:Security	EventCode=4768, 4769, 4770
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredAccounts	High-value accounts (e.g., Domain Admins) for anomalous ticket issuance or replay activity.
ReplayDetectionWindow	Time window for correlating duplicate or replayed Kerberos authentications.

AN0494 · Linux

Detects exploitation of authentication daemons or PAM modules. Defender perspective includes failed or anomalous PAM authentications, abnormal segfaults in authentication services, and exploitation attempts followed by successful unauthorized logins. Correlation identifies memory corruption, replay attempts, and privilege escalation tied to credential services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	NSM:Connections	Repeated failed authentication attempts or replay patterns
Process CreationDC0032	auditd:SYSCALL	execve: Suspicious binaries or scripts interacting with authentication binaries (sshd, gdm, login)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuthServiceList	List of monitored authentication services (e.g., sshd, gdm, PAM modules).
FailureThreshold	Number of failed authentications within a window before escalating to replay suspicion.

AN0495 · macOS

Detects exploitation attempts against macOS authentication frameworks such as OpenDirectory or Keychain. Defender perspective includes abnormal crashes in opendirectoryd, unauthorized Keychain API usage, and unusual sudo or login events. Correlation links unexpected process behavior with credential access anomalies.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	execve: Processes unexpectedly invoking Keychain or authentication APIs
Application Log ContentDC0038	macos:unifiedlog	opendirectoryd crashes or abnormal authentication errors

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedAPIs	List of authentication and Keychain-related APIs to monitor for unauthorized access.
CrashCorrelationWindow	Time window for correlating authentication service crashes with subsequent suspicious access.

AN0496 · Identity Provider

Detects exploitation of vulnerabilities in cloud identity providers (IdPs) such as Azure AD or Okta for credential access. Defender perspective includes anomalous token creation or renewal, authentication bypass events, and API abuse to mint unauthorized tokens. Correlation highlights exploitation attempts tied to absent or inconsistent audit logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	azure:signinlogs	TokenIssued, TokenRenewed: Unexpected or anomalous token issuance events
Application Log ContentDC0038	m365:unified	ConsentGranted: Abuse of application integrations to mint tokens bypassing MFA

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TokenAnomalyThreshold	Threshold for anomalous token creation or renewal before alerting.
MonitoredAppIntegrations	Applications with privileged access that should be tightly monitored for misuse.

Exploitation for Credential Access detections T1212

9 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

73rd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs