ShinyHuntersG1057 ↗
Has collected credentials containing PII, ultimately selling the information on their DLS.12
tfMITRE ATT&CK sub-technique
Credentials T1589.001
sub-technique of T1589 Gather Victim Identity Information
- Tactic
- Reconnaissance
- Platform
- PRE
- Version
- 1.2
- Created
- 02 October 2020
- Last modified
- 24 October 2025
- Contributors
- Vinayak Wadhwa, Lucideus; Lee Christensen, SpecterOps; Toby Kohlenberg; Massimo Giaimo, Würth Group Cyber Defence Center
Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
6
Threat groupsTop 25%
Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Credentials MITRE reference T1589.001
Top 25%of all ATT&CK techniques for number of groups
6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
LAPSUS$G1004 ↗
Has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.12
ChimeraG0114 ↗
Has collected credentials for the target organization from previous breaches for use in brute force attacks.1
LeviathanG0065 ↗
Has collected compromised credentials to use for targeting efforts.1
Magic HoundG0059 ↗
Gathered credentials from two victims that they then attempted to validate across 75 different websites. Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.12
APT28G0007 ↗
Has harvested user's login credentials.1
All 6 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0027C0027 ↗
During C0027, Scattered Spider sent phishing messages via SMS to steal credentials.1
SolarWinds CompromiseC0024 ↗
For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.1
All 2 campaigns for this technique
Offense vs defense T1589.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 2
first rule: 2022 Q2 · 2 of 2 campaigns plottedCredentials detection strategy DET0813
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Credentials
1 platform
AN1945 · PRE
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.