Azure Consent To Application
Records consent to an application’s requested permissions.
Credential Access
Credential Access
Section titled “Credential Access”The adversary is trying to steal account names and passwords.
Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
In cloud environments, adversaries target API keys, service account credentials, and temporary security tokens. Techniques include querying instance metadata services (IMDS), accessing secrets managers, dumping environment variables from serverless functions, and harvesting credentials from code repositories or CI/CD pipelines.
View Credential Access on MITRE ATT&CK →Events Related to Credential Access
Section titled “Events Related to Credential Access”Explore this tactic in the map.
AWS GetParameters
Retrieves up to ten named Parameter Store parameters, optionally decrypting SecureString values.
AWS GetPasswordData
Retrieves encrypted Windows administrator password data for an EC2 instance.
AWS GetSecretValue
Retrieves the selected version of a Secrets Manager secret.
Azure Microsoft.AppConfiguration/configurationStores/listKeys/action
Retrieves access keys for an Azure App Configuration store.
Azure Microsoft.Batch/batchAccounts/listKeys/action
Retrieves shared keys for an Azure Batch account.
Azure Microsoft.ContainerRegistry/registries/listCredentials/action
Retrieves the shared admin credentials of an Azure Container Registry.
Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action
Requests local cluster-admin kubeconfig credentials for an AKS cluster.
Azure Microsoft.ContainerService/managedClusters/listClusterUserCredential/action
Retrieves the clusterUser kubeconfig for an AKS cluster.
Azure Microsoft.KeyVault/vaults/secrets/read
Reads the value of an Azure Key Vault secret.
Azure Microsoft.OperationalInsights/workspaces/sharedKeys/action
Retrieves primary and secondary shared keys for a Log Analytics workspace.
Azure Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action
Retrieves shared keys and connection strings for a Service Bus namespace authorization rule.
Azure Microsoft.Storage/storageAccounts/listKeys/action
Retrieves an Azure Storage account’s shared access keys.
Azure Microsoft.Storage/storageAccounts/regenerateKey/action
Regenerates a selected Azure Storage account access key.
Azure Microsoft.Web/sites/host/listKeys/action
Retrieves Azure Functions host, master, and system keys.
GCP SecretManagerService.AccessSecretVersion
Accesses the payload of a Secret Manager secret version.