Exploitation for Credential Access `T1212`

Tactic: Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.

Events covered

10 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 675	Pre-authentication failed (legacy Windows 2003 Kerberos event; superseded by 4771).
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4768	A Kerberos authentication ticket (TGT) was requested.
Security-Auditing	Event ID 4769	A Kerberos service ticket was requested.
Security-Auditing	Event ID 4771	Kerberos pre-authentication failed.
Security-Auditing	Event ID 4887	Certificate Services approved a certificate request and issued a certificate.
Defender-DeviceEvents	any	Defender event
Audit-CVE	Event ID 1	Possible detection of CVE: PossibleDetectionOfCVE.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

These 23 rules share fields, values, and exclusions.

Fields filtered most (45 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`process_name`	5	`eq` 4, `in` 1	`cat`, `dd`, `egrep`, `fgrep`, `kernel`
`host.os.type`	4	`eq` 4
`EventType`	3	`in` 2, `eq` 1	`exec`, `exec_event`, `ProcessRollup2`, `start`
`event.type`	3	`eq` 3	`start`
`process.args`	3	`wildcard` 2, `eq` 1, `in` 1, `starts_with` 1	`-eo`, `/tmp/`, `?:\windows\system32\davclnt.dll,davsetcookie`, `?:\windows\syswow64\davclnt.dll,davsetcookie`, `command`
`ActionUncommonlyPerformedByUser`	2	`eq` 2	`True`
`Authorization`	2	`contains` 2	`virtualmachines`
`CommandLine`	2	`contains` 1, `wildcard` 1	`/print/pipe/`, `/proc/*/mem`, `c:\windows\system32\davclnt.dll,davsetcookie`, `http`
`StartTime`	2	`ge` 2, `le` 2	`UEBAWindowEnd`, `UEBAWindowStart`
`UEBASourceIPLocation`	2	`is_not_null` 2
`aws::eventSource`	2	`eq` 2	`Azure AD`
`azure_ad::operation_name_value`	2	`eq` 2	`microsoft.compute/virtualmachines/runcommand/action`
`list_ActivityStatusValue`	2	`contains` 2	`succeeded`, `success`
`sourcetype`	2	`eq` 2	`kube:container:controller`
`user`	2	`is_not_null` 2

Top indicator values (210 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticManual Memory Dumping via Proc Filesystem elasticPotential Local NTLM Relay via HTTP elasticPotential Memory Dumping via dd	3	1078
`ActionUncommonlyPerformedByUser`	`eq`	`True` kusto[AzureSubscription] Suspicious Azure VM Run Command Execution Detected kustoAzure VM Run Command operation executed during suspicious login window	2	2
`Authorization`	`contains`	`virtualmachines` kusto[AzureSubscription] Suspicious Azure VM Run Command Execution Detected kustoAzure VM Run Command operation executed during suspicious login window	2	3
`EventType`	`in`	`exec` elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Proc Filesystem	2	201
`EventType`	`in`	`exec_event` elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Proc Filesystem	2	149
`EventType`	`in`	`start` elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Proc Filesystem	2	163
`StartTime`	`ge`	`UEBAWindowStart` kusto[AzureSubscription] Suspicious Azure VM Run Command Execution Detected kustoAzure VM Run Command operation executed during suspicious login window	2	2
`StartTime`	`le`	`UEBAWindowEnd` kusto[AzureSubscription] Suspicious Azure VM Run Command Execution Detected kustoAzure VM Run Command operation executed during suspicious login window	2	2
`aws::eventSource`	`eq`	`Azure AD` kusto[AzureSubscription] Suspicious Azure VM Run Command Execution Detected kustoAzure VM Run Command operation executed during suspicious login window	2	2
`azure_ad::operation_name_value`	`eq`	`microsoft.compute/virtualmachines/runcommand/action` kusto[AzureSubscription] Suspicious Azure VM Run Command Execution Detected kustoAzure VM Run Command operation executed during suspicious login window	2	4
`list_ActivityStatusValue`	`contains`	`succeeded` kusto[AzureSubscription] Suspicious Azure VM Run Command Execution Detected kustoAzure VM Run Command operation executed during suspicious login window	2	3
`list_ActivityStatusValue`	`contains`	`success` kusto[AzureSubscription] Suspicious Azure VM Run Command Execution Detected kustoAzure VM Run Command operation executed during suspicious login window	2	3
`sourcetype`	`eq`	`kube:container:controller` splunkKubernetes Nginx Ingress LFI splunkKubernetes Nginx Ingress RFI	2	2
`AIPCall`	`contains`	`name` kustoUnauthorized user access across AWS and Azure	1	2
`Action`	`eq`	`vulnerabilityAlert` kustoGitHub Security Vulnerability in Repository	1
`ActionType`	`starts_with`	`AppControl` kustoDetect device token stealing with WDAC	1	5
`ActivityType`	`contains`	`unauthorizedaccess:iamuser/consoleloginsuccess.b` kustoUnauthorized user access across AWS and Azure	1	2
`ActivityType`	`contains`	`unauthorizedaccess:iamuser/instancecredentialexfiltration.insideaws` kustoUnauthorized user access across AWS and Azure	1	2
`ActivityType`	`contains`	`unauthorizedaccess:iamuser/instancecredentialexfiltration.outsideaws` kustoUnauthorized user access across AWS and Azure	1	2
`ActivityType`	`contains`	`unauthorizedaccess:iamuser/maliciousipcaller` kustoUnauthorized user access across AWS and Azure	1
`ActivityType`	`contains`	`unauthorizedaccess:iamuser/maliciousipcaller.custom` kustoUnauthorized user access across AWS and Azure	1	2
`ActivityType`	`contains`	`unauthorizedaccess:iamuser/toripcaller` kustoUnauthorized user access across AWS and Azure	1	2
`AppDisplayName`	`eq`	`Azure Portal` kustoUnauthorized user access across AWS and Azure	1	2
`CommandLine`	`contains`	`/print/pipe/` sigmaSuspicious NTLM Authentication on the Printer Spooler Service	1
`CommandLine`	`contains`	`c:\windows\system32\davclnt.dll,davsetcookie` sigmaSuspicious NTLM Authentication on the Printer Spooler Service	1	3
`CommandLine`	`contains`	`http` sigmaSuspicious NTLM Authentication on the Printer Spooler Service	1	52
`CommandLine`	`contains`	`spoolss` sigmaSuspicious NTLM Authentication on the Printer Spooler Service	1
`CommandLine`	`contains`	`srvsvc` sigmaSuspicious NTLM Authentication on the Printer Spooler Service	1
`CommandLine`	`wildcard`	`/proc/*/mem` elasticManual Memory Dumping via Proc Filesystem	1
`ControlName_s`	`eq`	`AzureSecureScoreBlockLegacyAuthentication` kustoAzure secure score block legacy authentication	1

Exploitation for Credential Access `T1212`

Events covered

Authoring guide

Fields filtered most (45 distinct)

Top indicator values (210 distinct)

Rules under this technique

Sigma 5 rules

Elastic 6 rules

Splunk 3 rules

Kusto 9 rules

Exploitation for Credential Access T1212

Events covered

Authoring guide

Fields filtered most (45 distinct)

Top indicator values (210 distinct)

Rules under this technique

Sigma 5 rules

Elastic 6 rules

Splunk 3 rules

Kusto 9 rules

Exploitation for Credential Access `T1212`