T1212 — Exploitation for Credential Access

Tactic: Credential Access · Platforms: Linux, Windows, macOS, Identity Provider

Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute…

Sigma detection rules (4)

T1212 Exploitation for Credential Access

title: T1212 Exploitation for Credential Access
id: a5d85c86-45be-4878-8adf-cae33a904093
description: 'Detects high-risk memory-read access to lsass.exe as a proxy for post-exploit credential extraction. (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: MonitoredAccounts, ReplayDetectionWindow.'
references:
  - https://attack.mitre.org/techniques/T1212
author: Shahrukh Khan
date: 2026-02-22
license: MIT
tags:
  - attack.credential-access
  - attack.t1212

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '10'
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x147a'
      - '0x1fffff'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - EDR/AV agents accessing lsass.exe legitimately.

level: medium

T1212 Exploitation for Credential Access

title: T1212 Exploitation for Credential Access
id: f129d460-2c56-44e4-b321-120fee6fe5db
description: 'Detection Strategy for Exploitation for Credential Access. The prior version declared service: syslog while matching type: USER_AUTH and res fields, which are actually auditd fields rather than syslog fields, and its logic (any single failed authentication) is indistinguishable from an ordinary bad password with no exploit-specific signal. This version corrects the logsource to auditd and instead flags ANOM_ABEND records (auditd abnormal-termination and crash events, for example SIGSEGV or SIGABRT) for authentication-related daemons (sshd, krb5kdc, slapd, winbindd, kadmind); a crash in an auth service process is a much stronger indicator of an in-progress memory-corruption exploit attempt than a routine failed login. Tune using: AuthServiceList, FailureThreshold.'
references:
  - https://attack.mitre.org/techniques/T1212
author: Shahrukh Khan
date: 2026-02-14
license: MIT
tags:
  - attack.credential-access
  - attack.t1212

logsource:
  product: linux
  service: auditd

detection:
  selection:
    type: ANOM_ABEND
    exe|contains:
      - '/sshd'
      - '/krb5kdc'
      - '/slapd'
      - '/winbindd'
      - '/kadmind'

  condition: selection

falsepositives:
  - Rare crashes of authentication services caused by resource exhaustion, misconfiguration, or unrelated software bugs rather than active exploitation; correlate with a subsequent successful authentication or privilege change from the same source to raise confidence. FailureThreshold burst correlation across accounts remains a SIEM-side signal this single rule cannot supply.

level: medium

T1212 Exploitation for Credential Access

title: T1212 Exploitation for Credential Access
id: 419e1682-75a3-43f9-bab0-11f5bd7f7317
description: 'Detection Strategy for Exploitation for Credential Access. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedAPIs, CrashCorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1212
author: Shahrukh Khan
date: 2026-01-30
license: MIT
tags:
  - attack.credential-access
  - attack.t1212

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/securityd'
      - '/opendirectoryd'
      - '/authd'
  condition: selection

falsepositives:
  - Repeated crashes of authd, securityd, or opendirectoryd around authentication events may indicate exploitation for credential access, but the unified log alone cannot distinguish this from normal daemon instability without a memory-safety crash reporter feed.

level: high

T1212 Exploitation for Credential Access

title: T1212 Exploitation for Credential Access
id: 033e2eec-8355-4dbf-8d8b-b7d05f256e2c
description: 'Detection Strategy for Exploitation for Credential Access. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: TokenAnomalyThreshold, MonitoredAppIntegrations.'
references:
  - https://attack.mitre.org/techniques/T1212
author: Shahrukh Khan
date: 2026-06-26
license: MIT
tags:
  - attack.credential-access
  - attack.t1212

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '0'
  tokenreplay:
    RiskState: 'confirmedCompromised'

  condition: selection and tokenreplay

falsepositives:
  - Rare given RiskState confirmedCompromised is a strong signal, though detection latency means the exploitation itself is not directly observed, only the resulting compromised sign-in.

level: high

Explore