Credential Access
Credential Access is when a hacker tries to steal your usernames and passwords so they can log into your accounts as if they were you.
Credential Access refers to the methods adversaries use to obtain legitimate account names and passwords, such as keylogging or dumping memory, to gain unauthorized entry into systems and maintain persistence.
The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
evolution
- 1970 · historyFirst Password Theft
The Creeper worm demonstrated the first instance of unauthorized access by moving between systems, highlighting the vulnerability of credentials.
- 1988 · historyMorris Worm
The Morris worm utilized dictionary attacks to crack passwords, marking the first large-scale automated credential access attempt.
- 2013 · historyCredential Stuffing Emergence
Large-scale data breaches led to the rise of automated credential stuffing, where stolen credentials are used to gain unauthorized access to other services.
- 2017 · historyMITRE ATT&CK Framework
MITRE formally codified 'Credential Access' as a distinct tactical category, standardizing the classification of techniques used to steal account information.
- 2023 · historyAI-Driven Credential Harvesting
Adversaries began integrating LLMs to generate highly personalized phishing content to harvest credentials more effectively at scale.