πŸ“‚ 02 - ATT&CK Credential Access

Overview

MITRE ATT&CK: Credential Access (TA0006) β€” the adversary is trying to steal account names and passwords.

Credential access is the act of stealing or cracking the credentials of a service or a user inside a system often leads to persistence, impersonation or privilege escalation. The credentials can either be the password, tickets, tokens, etc.


🧠 Techniques

FileCreated
(incomplete) Active Directory - Pass-the-HashSeptember 06, 2026
(incomplete) Cache PoisoningMay 21, 2026
(incomplete) Client-side Template InjectionMay 21, 2026
(incomplete) CVE-2026-27944May 21, 2026
Active Directory - ACL Abuse (GenericAll & ForceChangePassword)Wednesday, July 22nd 2026, 4:08:44 am
Active Directory - AS-REP RoastingJuly 21, 2026
Active Directory - BadSuccessor (dMSA Abuse)September 06, 2026
Active Directory - DCSync AttackJuly 21, 2026
Active Directory - Deleted Object RestorationSeptember 06, 2026
Active Directory - KerberoastingJuly 20, 2026
Active Directory - LAPS Password Retrieval AbuseJuly 24, 2026
Active Directory - Password SprayingJuly 21, 2026
Active Directory - SeBackupPrivilege AbuseWednesday, July 22nd 2026, 2:51:47 am
Active Directory - Shadow Credentials AttackJuly 23, 2026
Active Directory - Silver Ticket AttackJuly 20, 2026
Active Directory - Targeted KerberoastingJuly 22, 2026
Autologon Credentials in RegistryJuly 21, 2026
Cross-site ScriptingMay 22, 2026
Forced NTLM Authentication (SCF, LNK, URL)July 24, 2026
GraphQL - Batching AttackWednesday, May 6th 2026, 7:51:54 am
IMAP - Mailbox EnumerationSeptember 07, 2026
Memory Forensics - Windows Credential Extraction from VM SnapshotsSeptember 06, 2026
Network Printer Credential CaptureJuly 21, 2026
NFS - Anonymous Share MountingSeptember 07, 2026
Offline Cracking of Password-Protected Files (-2john)July 24, 2026
Python - Class PollutionWednesday, April 15th 2026, 7:52:25 pm
Session FixationSunday, April 12th 2026, 4:56:52 pm
XSS - DOM ClobberingWednesday, May 6th 2026, 7:51:54 am

πŸ“¦ Tech Stack

FileCreated
DovecotSeptember 07, 2026
MySQLSeptember 07, 2026

πŸ› οΈ Tools

FileCreated
(incomplete) RubeusSeptember 06, 2026
BloodyADSeptember 06, 2026
FirepwdJuly 21, 2026
HashcatTuesday, February 17th 2026, 11:01:44 pm
ImpacketJuly 20, 2026
John the RipperJuly 24, 2026
NetExecJuly 20, 2026
Password Safe (pwsafe)July 22, 2026
ResponderJuly 24, 2026
Volatility 3September 06, 2026