Attack scenario
Credential theft
An adversary obtains passwords, tokens, sessions, or other authentication material and uses it to expand access.
Why this scenario matters
This view connects the attack path with preventive, detective, response, and recovery controls and helps identify gaps between technologies.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Collection
- Credential Access
- Lateral Movement
Relevant ATT&CK techniques
- T1003 OS Credential Dumping
- T1056 Input Capture
- T1110 Brute Force
- T1111 Multi-Factor Authentication Interception
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1557 Adversary-in-the-Middle
- T1550 Use Alternate Authentication Material
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.