CAPEC-560: Use of Known Domain Credentials
Description
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- MetaA decidedly abstract characterisation of a methodology or technique.
Mechanism of attack: Subvert Access Control
Prerequisites
- The system/application uses one factor password based authentication, SSO, and/or cloud-based authentication.
- The system/application does not have a sound password policy that is being enforced.
- The system/application does not implement an effective password throttling mechanism.
- The adversary possesses a list of known user accounts and corresponding passwords that may exist on the target.
Skills required
- LowOnce an adversary obtains a known credential, leveraging it is trivial.
Consequences
- ConfidentialityAccess ControlAuthentication
Gain Privileges
- ConfidentialityAuthorization
Read Data
- Integrity
Modify Data
Mitigations
- Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.
- Create a strong password policy and ensure that your system enforces this policy.
- Ensure users are not reusing username/password combinations for multiple systems, applications, or services.
- Do not reuse local administrator account credentials across systems.
- Deny remote use of local admin credentials to log into domain systems.
- Do not allow accounts to be a local administrator on more than one system.
- Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2.
- Monitor system and domain logs for abnormal credential access.
Related weaknesses (CWE)
- CWE-262Not Using Password Aging
- CWE-263Password Aging with Long Expiration
- CWE-307Improper Restriction of Excessive Authentication Attempts
- CWE-308Use of Single-factor Authentication
- CWE-309Use of Password System for Primary Authentication
- CWE-522Insufficiently Protected Credentials
- CWE-654Reliance on a Single Factor in a Security Decision
- CWE-1273Device Unlock Credential Sharing
ATT&CK techniques (CAPEC taxonomy mapping)
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-LAMLocal Account Monitoring1 shared
- D3-DAMDomain Account Monitoring1 shared
- D3-ALAccount Locking1 shared
- D3-AAAgent Authentication1 shared
- D3-RUAARestore User Account Access1 shared
- D3-ULAUnlock Account1 shared
- D3-UAPUser Account Permissions1 shared
- D3-CDPChange Default Password1 shared
- D3-AMAccess Modeling1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.