Valid Credentials: Steal cryptographic keys

Adversaries may obtain and abuse master or session keys to gain Initial Access or Persistence. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to communication channels. [1]

Standard/references: [2]

ID: T2009.001
Sub-technique of:  T2009
Platforms: None
Version: 2.0
Created: 25 August 2022
Last Modified: 21 April 2023

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

References