Complete technique description
Adversaries may target insecure credentials as a means to persist on a system or device or move laterally from one system or device to another. Insecure credentials may appear as default credentials which are pre-configured credentials on a system, device, or software that are well-known in documentation or hard-coded credentials which are built into the system, device, or software that cannot be changed or not easily changed because of the impact on control processes.[NIST SP 800-82r3][ICS-ALERT-13-164-01][OT IceFall]
Adversaries often times use insecure credentials to evade detection as they are typically forgotten about by system and device owners.
Official technique definition · Open in the interactive matrix
Parent and sub-techniques
Related pages are navigation context. Their tools, rules and lab results are not automatically inherited.
Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
Logon Session Creation · source-mapped
DC0067 collection page — Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.
Providers and collection configuration
- Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
- For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
- Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.
Required normalized fields: account, logon_id, logon_type, source_ip.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0067",
"collector": "illustrative-lab-collector",
"observation": {
"account": "LAB\\analyst",
"logon_id": "0x12345",
"logon_type": 3,
"source_ip": "192.0.2.10"
}
}
Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
Network Traffic Content · source-mapped
DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.
Providers and collection configuration
- Zeek: Connection and protocol metadata from traffic visible to the sensor.
- Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
- Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
- Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
- Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.
Required normalized fields: flow_id, protocol, method, path, payload_excerpt.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0085",
"collector": "illustrative-lab-collector",
"observation": {
"flow_id": "lab-flow-1",
"protocol": "http",
"method": "GET",
"path": "/lab-check",
"payload_excerpt": "LAB_TELEMETRY_CHECK"
}
}
Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.
User Account Authentication · source-mapped
DC0002 collection page — Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.
Providers and collection configuration
- Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.
- Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.
- Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately.
Required normalized fields: account, application, result, reason, source_ip.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0002",
"collector": "illustrative-lab-collector",
"observation": {
"account": "analyst@example.test",
"application": "lab-portal",
"result": "failure",
"reason": "invalid_credential",
"source_ip": "192.0.2.10"
}
}
Visibility limits: A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.
Simulation design and documented procedures
Atomic evidence: no compatible candidate in this snapshot. Live lab status: not run for these imported procedures.
Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.
No compatible Atomic procedure is present in this pinned evidence set. Technical feasibility has not been ruled out. A custom procedure must define the behavior, target, collection point, success observable and rollback before execution.
Technique-specific experiment contract
- Choose one procedure implementing T1694 Insecure Credentials; identify the observable behavior in the source definition, not just its tactic.
- Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
- Enable the collection sources above and verify a benign baseline reaches the detector.
- Run only the approved isolated scenario; capture native events and an independent behavior observable.
- Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.