ATT&CK technique
View on MITRE ATT&CK →
T1212
Exploitation for Credential Access
Credential Access
14 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script | production | 2026-10-09 |
| splunk | Kubernetes Nginx Ingress LFI | production | 2026-09-22 |
| elastic | Manual Memory Dumping via Proc Filesystem | production | 2026-09-18 |
| elastic | Potential Linux Credential Dumping via Proc Filesystem | production | 2026-09-18 |
| elastic | Segfault from Sensitive Process Detected | production | 2026-09-18 |
| elastic | Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121) | production | 2026-09-18 |
| elastic | Potential Local NTLM Relay via HTTP | production | 2026-09-18 |
| splunk | Kubernetes Nginx Ingress RFI | production | 2026-05-13 |
| sigma | GALLIUM IOCs | test | 2024-11-23 |
| sigma | Kerberos Manipulation | test | 2024-01-16 |
| sigma | Suspicious NTLM Authentication on the Printer Spooler Service | test | 2023-02-09 |
| sigma | Audit CVE Event | test | 2022-10-22 |
| sigma | Guacamole Two Users Sharing Session Anomaly | test | 2021-11-27 |
| sentinel | Azure VM Run Command operation executed during suspicious login window | Scheduled | — |