Procedure examples

Indrik Spider has collected credentials from infected systems, including domain accounts.

BlackByte captured credentials for or impersonated domain administration users.

APT3 leverages valid accounts after gaining credentials for use within the victim domain.

Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.

Naikon has used administrator credentials for lateral movement in compromised networks.

Sandworm Team has used stolen credentials to access administrative accounts within the domain.

OilRig has used an exfiltration tool named STEALHOOK to retreive valid domain credentials.

Aquatic Panda used multiple mechanisms to capture valid user accounts for victim domains to enable lateral movement and access to additional hosts in victim environments.

TA505 has used stolen domain admin accounts to compromise additional hosts.

Cinnamon Tempest has obtained highly privileged credentials such as domain administrator in order to deploy malware.

Chimera has used compromised domain accounts to gain access to the target environment.

ToddyCat has used compromised domain admin credentials to mount local network shares.

Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.

APT5 has used legitimate account credentials to move laterally through compromised environments.

Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.

Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.

VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.

Play has used valid domain accounts for access.

Magic Hound has used domain administrator accounts after dumping LSASS process memory.

ShinyHunters has used valid domain accounts to gain initial access or to escalate privileges within environments.