LLMNR/NBT-NS Poisoning and SMB Relay

T1557 - Adversary-in-the-Middle ARP Cache Poisoning

Spoofing

Password Guessing

Password Cracking
T1110 - Brute Force
T1621 - Multi-Factor Authentication Request Generation Password Spraying

Credential Stuffing

T1040 - Network Sniffing

Keychain

LSASS Memory Securityd Memory

Security Account Manager T1555 - Credentials from Password Stores Credentials from Web Browsers

NTDS Windows Credential Manager

LSA Secrets Password Managers

T1003 - OS Credential Dumping
Cached Domain Credentials
DCSync T1212 - Exploitation for Credential Access
Proc Filesystem

/etc/passwd and /etc/shadow

T1187 - Forced Authentication
MITRE ATT&CK / Credential Access
T1528 - Steal Application Access Token
Web Cookies
T1606 - Forge Web Credentials
SAML Tokens
T1649 - Steal or Forge Authentication Certificates
Keylogging

Golden Ticket GUI Input Capture

T1056 - Input Capture
Silver Ticket Web Portal Capture
T1558 - Steal or Forge Kerberos Tickets
Kerberoasting Credential API Hooking

AS-REP Roasting
Domain Controller Authentication

Password Filter DLL

T1539 - Steal Web Session Cookie
Pluggable Authentication Modules

T1556 - Modify Authentication Process Network Device Authentication

T1552 - Unsecured Credentials
Reversible Encryption
Credentials In Files Multi-Factor Authentication
Credentials in Registry Hybrid Identity

Bash History

Private Keys T1111 - Multi-Factor Authentication Interception

Cloud Instance Metadata API

Group Policy Preferences

Container API

@hackinarticles https://github.com/Ignitetechnologies https://in.linkedin.com/company/hackingarticles