T1212 Exploitation for Credential Access — Detection Rules

Source-backed rule directory

• Guacamole Two Users Sharing Session Anomaly · test · high · {"product":"linux","service":"guacamole"}
• Audit CVE Event · test · critical · {"product":"windows","service":"application"}
• Kerberos Manipulation · test · high · {"product":"windows","service":"security"}
• Suspicious NTLM Authentication on the Printer Spooler Service · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0174 Detection Strategy for Exploitation for Credential Access

AN0493 Analytic 0493

Detects adversary exploitation of authentication mechanisms or credential validation processes. Defender perspective includes forged Kerberos tickets (e.g., MS14-068), abnormal LSASS memory access, replayed authentication attempts, and unexpected crashes of authentication services. Multi-event correlation ties exploitation attempts to abnormal process creation, service instability, and suspicious authentication events.

AN0494 Analytic 0494

Detects exploitation of authentication daemons or PAM modules. Defender perspective includes failed or anomalous PAM authentications, abnormal segfaults in authentication services, and exploitation attempts followed by successful unauthorized logins. Correlation identifies memory corruption, replay attempts, and privilege escalation tied to credential services.

AN0495 Analytic 0495

Detects exploitation attempts against macOS authentication frameworks such as OpenDirectory or Keychain. Defender perspective includes abnormal crashes in opendirectoryd, unauthorized Keychain API usage, and unusual sudo or login events. Correlation links unexpected process behavior with credential access anomalies.

AN0496 Analytic 0496

Detects exploitation of vulnerabilities in cloud identity providers (IdPs) such as Azure AD or Okta for credential access. Defender perspective includes anomalous token creation or renewal, authentication bypass events, and API abuse to mint unauthorized tokens. Correlation highlights exploitation attempts tied to absent or inconsistent audit logs.