Technique
technique:unauthorized_access_using_retained_credentials
Use of active former-employee or shared credentials to access systems after employment ended.
Use of active former-employee or shared credentials to access systems after employment ended.
“His account was not disabled when he was let go, and it was two months later now.”
“The username and password was still the same from when he was working there.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Omar | Explicit | 108 |
| incoming | USES | Marq | Explicit | 108 |
Omar USES Unauthorized access using retained credentials
Omar used another employee's still-active login after his own dealership account had been disabled.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“He was able to use this other employee’s login to access the computers at this car dealership.”
Marq USES Unauthorized access using retained credentials
Two months after being fired, Marq used retained credentials to access his former employer's administration portal and customer servers.
Explicit Confidence 99% · Marq EP 108 Details
“I just checked to see if I still had access to one of the servers where we administered several of our clients. I still had access to everything.”
“He had remembered his username and password to get into that dashboard when he worked there, and he tried to log into the portal, and it worked.”