Credential Access.

Credential Access (MITRE ATT&CK tactic TA0006) groups techniques adversaries use to obtain credentials they can reuse to authenticate as legitimate users. Its anchor technique is T1003 OS Credential Dumping, whose sub-techniques map neatly to where secrets live: T1003.001 (LSASS memory), T1003.002 (SAM registry hive), T1003.003 (NTDS.dit on a domain controller), T1003.004 (LSA secrets), T1003.006 (DCSync via the directory-replication protocol), and T1003.008 (/etc/shadow on Linux). Adjacent techniques include kerberoasting and AS-REP roasting, NTLM capture with Responder, browser-credential and cloud-token theft, and MFA phishing or OAuth-consent abuse.

Where credentials get stolen

flowchart TD
  A[Adversary with local admin/SYSTEM] --> B[LSASS memory<br/>T1003.001]
  A --> C[SAM hive<br/>T1003.002]
  A --> D[NTDS.dit on DC<br/>T1003.003]
  A --> E[DCSync replication<br/>T1003.006]
  B --> F[Plaintext / NT hashes / tickets]
  C --> F
  D --> F
  E --> F
  F --> G[Lateral movement]
  F --> H[Privilege escalation]
  F --> I[Persistence]

Because these techniques abuse legitimate OS features rather than dropping malware, they frequently evade signature-based tools — the 2017 NotPetya and countless ransomware intrusions pivoted on LSASS-dumped credentials to spread. Defenders deploy Windows Credential Guard and LSA protection (RunAsPPL), enforce phishing-resistant MFA, adopt a tiered-admin model to stop domain-admin logons on workstations, vault and rotate privileged secrets, disable NTLM where possible, and alert on LSASS handle access, ntdsutil use, and anomalous replication (DCSync) requests.