adpare
81 lines
5.4 KiB
JSON
81 lines
5.4 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--4788aacd-4da1-4f73-aa63-eb7768298bb8",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"type": "attack-pattern",
|
|
"id": "attack-pattern--9c306d8d-cde7-4b4c-b6e8-d0bb16caca36",
|
|
"created": "2018-04-18T17:59:24.739Z",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"revoked": false,
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/techniques/T1212",
|
|
"external_id": "T1212"
|
|
},
|
|
{
|
|
"source_name": "Bugcrowd Replay Attack",
|
|
"description": "Bugcrowd. (n.d.). Replay Attack. Retrieved September 27, 2023.",
|
|
"url": "https://www.bugcrowd.com/glossary/replay-attack/"
|
|
},
|
|
{
|
|
"source_name": "Comparitech Replay Attack",
|
|
"description": "Justin Schamotta. (2022, October 28). What is a replay attack?. Retrieved September 27, 2023.",
|
|
"url": "https://www.comparitech.com/blog/information-security/what-is-a-replay-attack/"
|
|
},
|
|
{
|
|
"source_name": "ADSecurity Detecting Forged Tickets",
|
|
"description": "Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December 23, 2015.",
|
|
"url": "https://adsecurity.org/?p=1515"
|
|
},
|
|
{
|
|
"source_name": "Storm-0558 techniques for unauthorized email access",
|
|
"description": "Microsoft Threat Intelligence. (2023, July 14). Analysis of Storm-0558 techniques for unauthorized email access. Retrieved September 18, 2023.",
|
|
"url": "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/"
|
|
},
|
|
{
|
|
"source_name": "Microsoft Midnight Blizzard Replay Attack",
|
|
"description": "Microsoft Threat Intelligence. (2023, June 21). Credential Attacks. Retrieved September 12, 2024.",
|
|
"url": "https://x.com/MsftSecIntel/status/1671579359994343425"
|
|
},
|
|
{
|
|
"source_name": "Technet MS14-068",
|
|
"description": "Microsoft. (2014, November 18). Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780). Retrieved December 23, 2015.",
|
|
"url": "https://technet.microsoft.com/en-us/library/security/ms14-068.aspx"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"modified": "2025-10-24T17:49:08.674Z",
|
|
"name": "Exploitation for Credential Access",
|
|
"description": "Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.\u00a0\n\nCredentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions.(Citation: Technet MS14-068)(Citation: ADSecurity Detecting Forged Tickets) Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges.(Citation: Bugcrowd Replay Attack)(Citation: Comparitech Replay Attack)(Citation: Microsoft Midnight Blizzard Replay Attack)\n\nSuch exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal.(Citation: Storm-0558 techniques for unauthorized email access)\n\nExploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "credential-access"
|
|
}
|
|
],
|
|
"x_mitre_attack_spec_version": "3.2.0",
|
|
"x_mitre_contributors": [
|
|
"John Lambert, Microsoft Threat Intelligence Center",
|
|
"Mohit Rathore"
|
|
],
|
|
"x_mitre_deprecated": false,
|
|
"x_mitre_domains": [
|
|
"enterprise-attack"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"x_mitre_platforms": [
|
|
"Linux",
|
|
"Windows",
|
|
"macOS",
|
|
"Identity Provider"
|
|
],
|
|
"x_mitre_version": "1.6"
|
|
}
|
|
]
|
|
} |