What is credential access in a cyberattack?
Credential access is the tactic of stealing passwords, hashes, tickets and tokens so that the attacker can log in as someone legitimate. Common techniques are dumping credentials from a computer's memory, reading passwords saved in browsers or scripts, guessing or spraying passwords against login services, capturing them on the network with adversary-in-the-middle tricks, and requesting service tickets to crack offline. Defences are multi-factor authentication (MFA), long unique passwords for service accounts, fewer administrator logins on ordinary workstations, and endpoint protection against memory dumping. Part of it is visible on the network, such as many failed connections from one host to login services, or ARP tricks on a segment; most happens on hosts and in the directory. NetSenX sees the network side and, above all, what stolen credentials are used for next: new sessions between hosts.