tfMITRE ATT&CK technique

Exploitation for Credential Access T1212

Tactic: Credential Access
Platforms: Linux, Windows, macOS, Identity Provider
Version: 1.6
Created: 18 April 2018
Last modified: 24 October 2025
Contributors: John Lambert, Microsoft Threat Intelligence Center; Mohit Rathore

Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules73rd pct

Detection rules73rd percentile · 71% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1212

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 3

Data component	Name	Channel
User Account AuthenticationDC0002	WinEventLog:Security	EventCode=4768, 4769, 4770
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Data component

Name

Channel

User Account AuthenticationDC0002

WinEventLog:Security

EventCode=4768, 4769, 4770

Process AccessDC0035

WinEventLog:Sysmon

EventCode=10

Field	What you tune
MonitoredAccounts	High-value accounts (e.g., Domain Admins) for anomalous ticket issuance or replay activity.
ReplayDetectionWindow	Time window for correlating duplicate or replayed Kerberos authentications.

Field

What you tune

MonitoredAccounts

High-value accounts (e.g., Domain Admins) for anomalous ticket issuance or replay activity.

ReplayDetectionWindow

Time window for correlating duplicate or replayed Kerberos authentications.

Data component	Name	Channel
User Account AuthenticationDC0002	NSM:Connections	Repeated failed authentication attempts or replay patterns
Process CreationDC0032	auditd:SYSCALL	execve: Suspicious binaries or scripts interacting with authentication binaries (sshd, gdm, login)

Field	What you tune
AuthServiceList	List of monitored authentication services (e.g., sshd, gdm, PAM modules).
FailureThreshold	Number of failed authentications within a window before escalating to replay suspicion.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	execve: Processes unexpectedly invoking Keychain or authentication APIs
Application Log ContentDC0038	macos:unifiedlog	opendirectoryd crashes or abnormal authentication errors

Field	What you tune
WatchedAPIs	List of authentication and Keychain-related APIs to monitor for unauthorized access.
CrashCorrelationWindow	Time window for correlating authentication service crashes with subsequent suspicious access.

Data component	Name	Channel
User Account AuthenticationDC0002	azure:signinlogs	TokenIssued, TokenRenewed: Unexpected or anomalous token issuance events
Application Log ContentDC0038	m365:unified	ConsentGranted: Abuse of application integrations to mint tokens bypassing MFA

Field	What you tune
TokenAnomalyThreshold	Threshold for anomalous token creation or renewal before alerting.
MonitoredAppIntegrations	Applications with privileged access that should be tightly monitored for misuse.

Offense vs defense T1212

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 3

Data component	Name	Channel
User Account AuthenticationDC0002	WinEventLog:Security	EventCode=4768, 4769, 4770
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Data component

Name

Channel

User Account AuthenticationDC0002

WinEventLog:Security

EventCode=4768, 4769, 4770

Process AccessDC0035

WinEventLog:Sysmon

EventCode=10

Field	What you tune
MonitoredAccounts	High-value accounts (e.g., Domain Admins) for anomalous ticket issuance or replay activity.
ReplayDetectionWindow	Time window for correlating duplicate or replayed Kerberos authentications.

Field

What you tune

MonitoredAccounts

High-value accounts (e.g., Domain Admins) for anomalous ticket issuance or replay activity.

ReplayDetectionWindow

Time window for correlating duplicate or replayed Kerberos authentications.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)	Generic	test	-	windows	WinEventLog Application	Impact Endpoint Denial of Service Application or System Exploitation Execution Exploitation for Client Execution Credential Access Exploitation for Credential Access Privilege Escalation Exploitation for Privilege Escalation Stealth Exploitation for Stealth Lateral Movement Exploitation of Remote Services	CVE-2020-0601	critical	Florian Roth (Nextron Systems), Zach Mathis	2020-01-15	2022-10-22	48d91a3a-2363-43ba-a456-ca71ac3da5c2
	Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Credential Access Exploitation for Credential Access	-	high	Tim Burrell	2020-02-07	2024-11-23	440a56bf-7873-4439-940a-1c8a671073c2
	Detects suspicious session with two users present	Generic	test	-	linux	Apache Guacamole	Credential Access Exploitation for Credential Access	-	high	Florian Roth (Nextron Systems)	2020-07-03	2021-11-27	1edd77db-0669-4fef-9598-165bda82826d
	Detects failed Kerberos TGT issue operation. (...)	Generic	test	-	windows	WinEventLog Security	Credential Access Exploitation for Credential Access	-	high	Florian Roth (Nextron Systems)	2017-02-10	2024-01-16	f7644214-0eb0-4ace-9455-331ec4c09253
Splunk	The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. (...)	Generic	stable	cloud_audit	-	Kubernetes	Credential Access Exploitation for Credential Access	-	medium	Patrick Bareiss, Splunk	2021-08-23	2026-09-22	0f83244b-425b-4528-83db-7a88c5f66e48
Splunk	The following analytic detects remote file inclusion (RFI) attacks targeting Kubernetes Nginx ingress controllers. (...)	Generic	stable	cloud_audit	-	Kubernetes	Credential Access Exploitation for Credential Access	-	medium	Patrick Bareiss, Splunk	2021-08-23	2026-05-13	fc5531ae-62fd-4de6-9c36-b4afdae8ca95
	Detects a possible remote NTLM hash change through SAMR API SamiChangePasswordUser() or SamSetInformationUser(). (...)	Unsupported	unsupported	network_connection	windows	WinEventLog Security	Credential Access Exploitation for Credential Access	-	medium	Dimitrios Slamaris	2017-06-09	2023-02-24	7818b381-5eb1-4641-bea5-ef9e4cfb5951	-
	Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Exploitation for Credential Access	-	high	Elastic (idea), Tobias Michalski (Nextron Systems)	2022-05-04	2023-02-09	bb76d96b-821c-47cf-944b-7ce377864492
Splunk	This analytic detects the execution of the ConvertTo-AADIntBackdoor command via PowerShell Script Block Logging. (...)	Generic	stable	ps_script	windows	PowerShell	Command and Control Application Layer Protocol Web Protocols Discovery Domain Trust Discovery Credential Access Exploitation for Credential Access Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Raven Tait, Splunk	2026-05-05	2026-10-09	59a8662f-f616-4494-8fa1-29ae77fc2018

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)	Generic	test	-	windows	WinEventLog Application	Impact Endpoint Denial of Service Application or System Exploitation Execution Exploitation for Client Execution Credential Access Exploitation for Credential Access Privilege Escalation Exploitation for Privilege Escalation Stealth Exploitation for Stealth Lateral Movement Exploitation of Remote Services	CVE-2020-0601	critical	Florian Roth (Nextron Systems), Zach Mathis	2020-01-15	2022-10-22	48d91a3a-2363-43ba-a456-ca71ac3da5c2
	Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Credential Access Exploitation for Credential Access	-	high	Tim Burrell	2020-02-07	2024-11-23	440a56bf-7873-4439-940a-1c8a671073c2
	Detects suspicious session with two users present	Generic	test	-	linux	Apache Guacamole	Credential Access Exploitation for Credential Access	-	high	Florian Roth (Nextron Systems)	2020-07-03	2021-11-27	1edd77db-0669-4fef-9598-165bda82826d
	Detects failed Kerberos TGT issue operation. (...)	Generic	test	-	windows	WinEventLog Security	Credential Access Exploitation for Credential Access	-	high	Florian Roth (Nextron Systems)	2017-02-10	2024-01-16	f7644214-0eb0-4ace-9455-331ec4c09253
Splunk	The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. (...)	Generic	stable	cloud_audit	-	Kubernetes	Credential Access Exploitation for Credential Access	-	medium	Patrick Bareiss, Splunk	2021-08-23	2026-09-22	0f83244b-425b-4528-83db-7a88c5f66e48
Splunk	The following analytic detects remote file inclusion (RFI) attacks targeting Kubernetes Nginx ingress controllers. (...)	Generic	stable	cloud_audit	-	Kubernetes	Credential Access Exploitation for Credential Access	-	medium	Patrick Bareiss, Splunk	2021-08-23	2026-05-13	fc5531ae-62fd-4de6-9c36-b4afdae8ca95
	Detects a possible remote NTLM hash change through SAMR API SamiChangePasswordUser() or SamSetInformationUser(). (...)	Unsupported	unsupported	network_connection	windows	WinEventLog Security	Credential Access Exploitation for Credential Access	-	medium	Dimitrios Slamaris	2017-06-09	2023-02-24	7818b381-5eb1-4641-bea5-ef9e4cfb5951	-
	Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Exploitation for Credential Access	-	high	Elastic (idea), Tobias Michalski (Nextron Systems)	2022-05-04	2023-02-09	bb76d96b-821c-47cf-944b-7ce377864492
Splunk	This analytic detects the execution of the ConvertTo-AADIntBackdoor command via PowerShell Script Block Logging. (...)	Generic	stable	ps_script	windows	PowerShell	Command and Control Application Layer Protocol Web Protocols Discovery Domain Trust Discovery Credential Access Exploitation for Credential Access Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Raven Tait, Splunk	2026-05-05	2026-10-09	59a8662f-f616-4494-8fa1-29ae77fc2018

Exploitation for Credential Access T1212

Exploitation for Credential Access T1212

Exploitation for Credential Access MITRE reference T1212

Offense vs defense T1212

Exploitation for Credential Access detection strategy DET0174

Detection Strategy for Exploitation for Credential Access

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Exploitation for Credential Access MITRE reference T1212

Offense vs defense T1212

Exploitation for Credential Access detection strategy DET0174

Detection Strategy for Exploitation for Credential Access

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Exploitation for Credential Access detections T1212

Exploitation for Credential Access detections T1212