HardenD3-CH
Credential Hardening
Definition
Credential Hardening techniques modify system or network properties in order to protect system or network/domain credentials.
- D3FEND ID
- D3-CH
- Tactic
- Harden
- Certification relevance
- Security+CISSPCCSP
Sub-techniques
ATT&CK techniques it counters
11 techniques, 38 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1003OS Credential Dumping
- T1098Account Manipulation
- T1110Brute Force
- T1134Access Token Manipulation
- T1142Keychain
- T1528Steal Application Access Token
- T1539Steal Web Session Cookie
- T1550Use Alternate Authentication Material
- T1552Unsecured Credentials
- T1558Steal or Forge Kerberos Tickets
- T1606Forge Web Credentials
Across MITRE's defensive frameworks
Linked through the 11 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2016-04-004Successful Local Account Login1 shared
- CAR-2019-04-004Credential Dumping via Mimikatz1 shared
- CAR-2019-07-002Lsass Process Dump via Procdump1 shared
- CAR-2019-08-001Credential Dumping via Windows Task Manager1 shared
- CAR-2019-08-002Active Directory Dumping via NTDSUtil1 shared
- CAR-2020-05-001MiniDump of LSASS1 shared
- CAR-2020-09-004Credentials in Files & Registry1 shared
- CAR-2021-05-008Certutil exe certificate extraction1 shared
- CAR-2021-05-011Create Remote Thread into LSASS1 shared
- CAR-2013-07-001Suspicious Arguments1 shared