T1212No distinct observable

Exploitation for Credential Access

Credential AccessLinux, Windows, macOS, Identity Provider

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

No single-event observable in this brief belongs to T1212 itself. AN0493's Sysmon EventID 10 leg is the LSASS handle-access observable already published as the T1003.001 rule (id 3e50b6f6-5dbc-4689-bf57-4bbff2bdd162); re-issuing it under a credential-access-by-exploitation tag would be the same query wearing a different technique. AN0493's other leg, Security 4768/4769/4770, carries no field that separates a forged or replayed ticket from a normal one on one event — TicketEncryptionType/TicketOptions/Status are the Kerberoasting and downgrade signals already owned by T1558.003, and MS14-068 detection needs a PAC-versus-account comparison across events. Both of the analytic's tuning knobs, MonitoredAccounts and ReplayDetectionWindow, are correlation windows, and lib/sigma supports no aggregations, no timeframes and no cross-event joins. […]

Covered instead by T1003.001, T1558.003.

What the technique is

Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is MS14-068, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges. Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal. Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.

Read it on attack.mitre.org

What MITRE says you would watch

AN0493
Detects adversary exploitation of authentication mechanisms or credential validation processes. Defender perspective includes forged Kerberos tickets (e.g., MS14-068), abnormal LSASS memory access, replayed authentication attempts, and unexpected crashes of authentication services. Multi-event correlation ties exploitation attempts to abnormal process creation, service instability, and suspicious authentication events.
AN0494
Detects exploitation of authentication daemons or PAM modules. Defender perspective includes failed or anomalous PAM authentications, abnormal segfaults in authentication services, and exploitation attempts followed by successful unauthorized logins. Correlation identifies memory corruption, replay attempts, and privilege escalation tied to credential services.
AN0495
Detects exploitation attempts against macOS authentication frameworks such as OpenDirectory or Keychain. Defender perspective includes abnormal crashes in opendirectoryd, unauthorized Keychain API usage, and unusual sudo or login events. Correlation links unexpected process behavior with credential access anomalies.