Technique
technique:credential_interception
Also: monitoring on the wire
Recovery of unencrypted credentials observed on the network for use in pivoting to additional systems.
Recovery of unencrypted credentials observed on the network for use in pivoting to additional systems.
“sometimes people still have unencrypted credentials flying around their network”
“With sufficient amount of monitoring on the wire, credentials were recovered”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | JekHyde and Carl physical penetration engagement | Explicit | 41 |
JekHyde and Carl physical penetration engagement INVOLVES credential interception
The team recovered unencrypted credentials by monitoring traffic on the network and used them to pivot into multiple systems.
Explicit Confidence 99% · Carl EP 41 Details
“With sufficient amount of monitoring on the wire, credentials were recovered”