Credential Access (TA0006)

The Attacker's Critical Power Grab & How to Stop It

Introduction: The "So What?" Hook

Credential Access is the attacker's art of stealing the digital keys, usernames, passwords, hashes, tokens, that unlock doors within your network. It’s not just about getting in; it’s about getting the keys to move freely, silently, and with authority once you're inside.

Why does this matter so much? Because in the cyber kill chain, initial access is often noisy and temporary. Credential Access is the pivot point that transforms a fragile foothold into a persistent, powerful position. Success here lets an attacker escalate privileges, move laterally to critical systems, and ultimately access the crown jewels, all while mimicking legitimate users, making detection incredibly difficult. If defenders fail at this stage, the entire network can become a playground for the adversary.

The Core Analogy: The Master Key Forger

Vocabulary Decoder Ring

• Credential Dumping: Extracting login information (like password hashes) from a system's memory or storage. Why it matters here: This is the primary method for stealing credentials from a compromised machine, often providing the keys to the rest of the network.
• Pass-the-Hash (PtH): An attack where an adversary uses a stolen password hash (not the plaintext password) to authenticate to a remote system. Why it matters here: It bypasses the need to crack the hash, allowing immediate lateral movement.
• Kerberos Ticket: A time-sensitive, encrypted network authentication ticket used in Windows Active Directory environments. Why it matters here: Stealing or forging these tickets (Golden/Silver Ticket attacks) grants attackers legitimate domain access.
• LSASS (Local Security Authority Subsystem Service): A Windows process that handles user authentication and stores credential data in memory. Why it matters here: It's the prime target for credential dumping tools like Mimikatz.
• MFA (Multi-Factor Authentication): A security system requiring two or more distinct forms of verification. Why it matters here: It's the most effective defensive control to mitigate many Credential Access techniques, especially phishing.

The Attacker's Playbook (Red Team View)

Common Techniques

• T1003: OS Credential Dumping: Stealing credentials stored in the OS, like from LSASS or the Security Account Manager (SAM) database.
• T1110: Brute Force: Systematically guessing passwords via trial and error.
• T1555: Credentials from Password Stores: Pulling saved passwords from browsers, email clients, or dedicated password managers.
• T1539: Steal Web Session Cookie: Hijacking active browser sessions to bypass login pages entirely.
• T1056: Input Capture: Using keyloggers or GUI input capture to record user keystrokes and mouse clicks.

Toolbox

• Mimikatz: The legendary tool for extracting plaintext passwords, hashes, and Kerberos tickets from Windows memory.
• Impacket: A Python toolkit with scripts like secretsdump.py for remote credential dumping via protocols like SMB.
• LaZagne: An application used to recover passwords stored locally on a system from numerous software.

Command-Line Glimpse

# Using Mimikatz to dump credentials from LSASS memory
privilege::debug          # Escalate to DEBUG privileges (often needed)
sekurlsa::logonpasswords  # Extract plaintext passwords and NTLM hashes from memory

# Result: Shows user names, domains, and (if cached) plaintext passwords or NTLM hashes.
# These hashes can be used for Pass-the-Hash attacks immediately.

The Defender's Handbook (Blue Team View)

SOC Reality Check: What You'll See in the Logs

• Windows Security Event ID 4688: A process (like mimikatz.exe or rundll32.exe) with a parent process of lsass.exe - a huge red flag for credential dumping.
• Excessive Logon Failures (Event ID 4625) followed by a Successful Logon (Event ID 4624) from the same source: Classic sign of a successful brute-force or password spray attack.
• Unexpected registry access to HKLM\SAM or HKLM\SECURITY hives: Indicates attempts to dump the SAM database.

Threat Hunter’s Eye: A Sample Hypothesis

"Hunt for processes with the name lsass.exe that have more than one child process. The legitimate LSASS rarely spawns children. Any child process (especially unknown ones) is highly suspicious and indicative of code injection for dumping."

Defensive Tools & Categories

• Endpoint Detection and Response (EDR): Tools like CrowdStrike, Microsoft Defender for Endpoint to detect process injection into LSASS.
• Privileged Access Management (PAM): Solutions like CyberArk or BeyondTrust to vault and manage privileged credentials.
• SIEM with Custom Alerting: Aggregating logs and alerting on the specific event sequences mentioned above.

Blue Team Command / Rule

# Sigma rule to detect potential LSASS credential dumping via process creation
title: Potential LSASS Memory Dump
status: experimental
description: Detects a process creation event where the parent process is lsass.exe, which is highly unusual and indicative of credential dumping.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\lsass.exe'
    condition: selection
falsepositives:
    - Legitimate administrative or security tools (should be very rare, whitelist explicitly)
level: high

Real-World Example: From Headlines to Logs

Narrative: The 2021 Colonial Pipeline ransomware attack, attributed to the DarkSide group, crippled a major US fuel pipeline. The initial access vector was a compromised virtual private network (VPN) account that did not have multi-factor authentication enabled.

Explicit Connection: In the Colonial Pipeline attack, the threat group DarkSide used Credential Access when they obtained a single VPN password, likely through a password leak or purchase on the dark web. This allowed them to authenticate directly to the corporate network as a legitimate user, bypassing perimeter defenses and immediately beginning their lateral movement to deploy ransomware.

Mapping the MITRE Landscape

Below are some of the primary Techniques within the Credential Access tactic (TA0006). Remember, each of these contains numerous sub-techniques, these are the high-level categories.

Key Takeaways & Immediate Actions

Further Learning & References

• Official MITRE ATT&CK Page: Credential Access (TA0006) - The definitive source for techniques and sub-techniques. Start here.
• CISA Alert: Threat Actors Use Brute Force Attacks to Obtain Access to Remote Desktop Protocols - A real-world government analysis of credential-based attacks with mitigation steps.
• SpecterOps Blog: Attacking Kerberos - A deep technical dive into one of the most critical credential systems in Windows environments.
• Microsoft Security Blog: The Scale of Credential Phishing - Understand the modern scale of the problem from a major defender's perspective.
• Internal/Contextual: After achieving Credential Access, attackers almost always move to Privilege Escalation (to get administrator keys) and Lateral Movement (to use those keys on other systems).