Detecttechnique
D3-CCSACredential Compromise Scope Analysis
Credential Compromise Scope Analysis
Definition
Determining which credentials may have been compromised by analyzing the user logon history of a particular system.
Defends against19
| Type | Target | Confidence | Tier |
|---|---|---|---|
| SubTechnique | Make and Impersonate Tokent1134.003 | 100% | live |
| SubTechnique | /etc/passwd and /etc/shadowt1003.008 | 100% | live |
| SubTechnique | Password Crackingt1110.002 | 100% | live |
| SubTechnique | Password Sprayingt1110.003 | 100% | live |
| Technique | Steal or Forge Kerberos Ticketst1558 | 100% | live |
| Technique | Steal Application Access Tokent1528 | 100% | live |
| SubTechnique | Create Process with Tokent1134.002 | 100% | live |
| Technique | Unsecured Credentialst1552 | 100% | live |
| SubTechnique | Additional Cloud Credentialst1098.001 | 100% | live |
| SubTechnique | NTDSt1003.003 | 100% | live |
| SubTechnique | Cached Domain Credentialst1003.005 | 100% | live |
| Technique | Steal Web Session Cookiet1539 | 100% | live |
| SubTechnique | Web Cookiest1606.001 | 100% | live |
| SubTechnique | Token Impersonation/Theftt1134.001 | 100% | live |
| SubTechnique | Web Session Cookiet1550.004 | 100% | live |
| SubTechnique | Application Access Tokent1550.001 | 100% | live |
| SubTechnique | Golden Tickett1558.001 | 100% | live |
| SubTechnique | Password Guessingt1110.001 | 100% | live |
| Technique | Forge Web Credentialst1606 | 100% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.