Esc
Credential Eviction
Definition
Credential Eviction techniques disable or remove compromised credentials from a computer network.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 4 techniques in this category, Credential Eviction.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Credential Eviction | D3-CE | Credential Eviction techniques disable or remove compromised credentials from a computer network. | |
| - Credential Revocation | D3-CR | Deleting a set of credentials permanently to prevent them from being used to authenticate. | |
| - Authentication Cache Invalidation | D3-ANCI | Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. | |
| - Account Locking | D3-AL | The process of temporarily disabling user accounts on a system or domain. |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Privilege Escalation
Account Manipulation
Access Token Manipulation
Valid Accounts
Abuse Elevation Control Mechanism
Impact
Account Access Removal
Persistence
Account Manipulation
Create Account
Valid Accounts
Credential Access
Brute Force
OS Credential Dumping
Steal or Forge Kerberos Tickets
Steal Application Access Token
Steal Web Session Cookie
Keychain
Unsecured Credentials
Forge Web Credentials
Defense Evasion
Access Token Manipulation
Valid Accounts
Use Alternate Authentication Material
Abuse Elevation Control Mechanism
References
All
Patent
The following references were used to develop the Credential Eviction knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
Account monitoring
Reference Type: Patent Organization: Forescout Technologies Author: Chunhui Zhan, Siying Yang