T1212Credential Access
Exploitation for Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by…
CVEs5
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.5
Reports3
Detections
5 Sigma rules tagged T1212Exploitation for Credential AccessT12125 general rules
- Audit CVE Eventcriticaltest
- GALLIUM IOCshightest
- Guacamole Two Users Sharing Session Anomalyhightest
- Kerberos Manipulationhightest
- Suspicious NTLM Authentication on the Printer Spooler Servicehightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Exploitation for Credential Access
5 CVEs, by priority. Each link shows its badge.- CVE-2024-53704SonicWall SonicOS SSLVPN Improper Authentication VulnerabilitySonicWall · SonicOSKEVRansomwarePublic exploitCritical · 9.8T1199Trusted RelationshipT1078.004Cloud Accounts+2 moreMITRE CTID mapping of the KEV entry · how it is exploited95.3%Top 0.13%79.8priority
- CVE-2023-22894Strapi Cleartext Storage of Sensitive Information VulnerabilityStrapi · StrapiKEVPublic exploitMedium · 4.9T1078Valid AccountsT1212Exploitation for Credential AccessAI mapping from the description · primary impact4.1%Top 9.2%74.6priority
- CVE-2022-22948VMware vCenter Server Incorrect Default File Permissions VulnerabilityVMware · vCenter ServerKEVPublic exploitMedium · 6.5T1078Valid AccountsT1068Exploitation for Privilege Escalation+1 more · 2 reportsMITRE CTID mapping of the KEV entry · primary impact13.3%Top 3.6%73.0priority
- CVE-2025-48927TeleMessage TM SGNL Initialization of a Resource with an Insecure Default VulnerabilityTeleMessage · TM SGNLKEVMedium · 5.3T1212Exploitation for Credential AccessT1555Credentials from Password Stores+1 moreMITRE CTID mapping of the KEV entry · how it is exploited11.6%Top 4%60.9priority
- CVE-2025-48928TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityTeleMessage · TM SGNLKEVMedium · 4.0T1212Exploitation for Credential AccessT1555Credentials from Password Stores+1 moreMITRE CTID mapping of the KEV entry · how it is exploited0.6%Top 52%50.3priority
Passages that support these links
The actor claimed he obtained the credentials through a path traversal vulnerability in Fortinet’s FortiGate secure sockets layer (SSL) VPN web portal (CVE-2018-13379).
w64.log >ppp.log2016-10-03T09:30:10 PowerShell.exe -ExecutionPolicy Bypass -File getpwd.ps1 >iistail.log In another example, BRONZE UNION leveraged the Kekeo credential abuse tool to exploit CVE-2014-6324, a vulnerability in Microsoft's implementation of the Kerberos network authentication