Exploitation for Credential Access T1212

Tactic: Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.

Events covered

9 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 20 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (39 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
process_name4eq 3, in 1cat, egrep, fgrep, kernel, ps
EventType3in 2, starts_with 1exec, exec_event, AppControl, ProcessRollup2, start
host.os.type3eq 3
CommandLine2contains 1, wildcard 1/print/pipe/, /proc/*/mem, c:\windows\system32\davclnt.dll,davsetcookie, http
event.type2eq 2start
process.args2eq 1, in 1, starts_with 1, wildcard 1-eo, /tmp/, ?:\Windows\SysWOW64\davclnt.dll,DavSetCookie, ?:\Windows\System32\davclnt.dll,DavSetCookie, command
sourcetype2eq 2kube:container:controller
AIPCall1contains 1name
Action1eq 1vulnerabilityAlert
ActionUncommonlyPerformedByUser1eq 1True
ActivityType1contains 1unauthorizedaccess:iamuser/consoleloginsuccess.b, unauthorizedaccess:iamuser/instancecredentialexfiltration..., unauthorizedaccess:iamuser/instancecredentialexfiltration...
AppDisplayName1eq 1Azure Portal
Authorization1contains 1virtualmachines
ControlName_s1eq 1AzureSecureScoreBlockLegacyAuthentication
EventID1eq 14104

Top indicator values (204 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
EventTypein
exec
2171
EventTypein
exec_event
2139
EventTypein
start
2134
EventTypein
ProcessRollup2
1117
EventTypein
executed
188
EventTypein
process_started
174
event.typeeq
start
2606
sourcetypeeq
kube:container:controller
22
AIPCallcontains
name
12
Actioneq
vulnerabilityAlert
1
ActionUncommonlyPerformedByUsereq
True
1
ActivityTypecontains
unauthorizedaccess:iamuser/consoleloginsuccess.b
12
ActivityTypecontains
unauthorizedaccess:iamuser/instancecredentialexfiltration.insideaws
12
ActivityTypecontains
unauthorizedaccess:iamuser/instancecredentialexfiltration.outsideaws
12
ActivityTypecontains
unauthorizedaccess:iamuser/maliciousipcaller
1
ActivityTypecontains
unauthorizedaccess:iamuser/maliciousipcaller.custom
12
ActivityTypecontains
unauthorizedaccess:iamuser/toripcaller
12
AppDisplayNameeq
Azure Portal
12
Authorizationcontains
virtualmachines
12
CommandLinecontains
/print/pipe/
1
CommandLinecontains
c:\windows\system32\davclnt.dll,davsetcookie
13
CommandLinecontains
http
139
CommandLinecontains
spoolss
1
CommandLinecontains
srvsvc
1
CommandLinewildcard
/proc/*/mem
1
ControlName_seq
AzureSecureScoreBlockLegacyAuthentication
1
EventIDeq
4104
1268
EventTypestarts_with
AppControl
15
GlobalPrevalencelt
250
14
Hashescontains
sha1=1c6452026c56efd2c94cea7e0f671eb55515edb0
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 5 rules

Elastic 4 rules

Splunk 3 rules

Kusto 8 rules