Credential Access — MITRE ATT&CK® Tactic TA0006

Tactical objective

Adversaries obtain passwords, hashes, tokens, tickets, keys, cookies, or other secrets that can be used to authenticate or impersonate an identity.

In ATT&CK, a tactic describes why an adversary performs an action. Credential Access is not necessarily a single chronological phase, and techniques associated with it can appear repeatedly or alongside other objectives during one operation.

This BMC path highlights 4 high-value profiles: Brute Force (T1110), Credentials from Password Stores (T1555), Unsecured Credentials (T1552), OS Credential Dumping (T1003). The complete ATT&CK catalog contains additional techniques and sub-techniques, so this page is a teaching sequence rather than an exhaustive replacement for the official matrix.

What defenders should ask

The best tactical questions connect observable behavior to an asset, identity, trust decision, and consequence. They help investigators test competing explanations instead of inferring intent solely from an alert label.

• Which secret or authentication artifact was exposed?
• Can it be replayed, cracked, exchanged, or used from another device?
• What accounts, sessions, applications, and trust paths depend on it?
• Which part of the environment is outside current telemetry or control scope?
• What earlier and later behaviors would strengthen or weaken this hypothesis?

Architecture and preventive controls

Prevention of credential access behavior rarely depends on one product. Architecture, identity, configuration, network paths, software maintenance, user workflow, and recovery design all influence the available opportunities.

Control design should identify where the organization can deny, constrain, slow, or expose the behavior. For every control, define the expected evidence, exception process, failure mode, and owner.

• Use phishing-resistant MFA and protected credential stores.
• Reduce standing privilege and reusable secrets.
• Protect LSASS, browser stores, keys, and service-account material.
• Detect guessing, dumping, token theft, and abnormal authentication.

Detection and evidence

Detection for credential access should focus on behavior and context rather than an identifier alone. The same command, protocol, or configuration action may be authorized or malicious depending on the actor, asset, sequence, and expected workflow.

Use multiple evidence sources when possible. Independent identity, endpoint, network, cloud, and application records are especially valuable when an adversary can alter host-local evidence.

• Authentication and lockout patterns
• Credential-store and sensitive-process access
• Ticket, token, and session activity
• Secret scanning and file-access events
• Asset criticality, identity role, and change-window context
• Correlated preceding and follow-on behaviors across tactics

Investigation and response

Build a timeline that separates observed actions from inferred objectives. Preserve the event, process, account, resource, destination, and configuration evidence supporting every mapping.

Response priorities for credential access should address the active behavior while also identifying the access and dependencies that made it possible. Containment that removes one symptom but leaves the enabling identity, trust path, or persistence mechanism can create a false sense of closure.

• Confirm the affected scope and earliest supported activity.
• Identify accounts, hosts, workloads, applications, and external infrastructure involved.
• Preserve volatile and centralized evidence before making disruptive changes.
• Contain the enabling path and validate that controls are functioning.
• Search for related techniques and repeat activity across the environment.
• Document confidence, residual risk, and the conditions for recovery.

Safe tabletop exercise

Create a fictional scenario in which an adversary pursues the Credential Access objective against a representative business service. Select two techniques from this path and identify the architecture, identity, and evidence required for the behavior.

Have one participant act as the investigator and another as the service owner. Compare what security tooling reports with what the service owner knows about expected behavior. Record one prevention gap, one detection gap, and one recovery or resilience improvement.

• State the assumed adversary access and objective.
• Define the affected platform and business service.
• List expected benign activity that could resemble the behavior.
• Identify the minimum evidence needed to reach a defensible conclusion.
• Map only what the scenario actually supports.

Attribution and scope

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.

This article is an original Bare Metal Cyber educational treatment of tactic TA0006 reviewed against Enterprise ATT&CK v19.2. Verify current technique relationships and object status on the official tactic page.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Authoritative sources

• MITRE ATT&CK® Credential Access Tactic
• MITRE ATT&CK® Data & Tools
• MITRE ATT&CK® Legal and Branding Guidance