Skip to content

M1043 Credential Access Protection

Credential Access Protection focuses on implementing measures to prevent adversaries from obtaining credentials, such as passwords, hashes, tokens, or keys, that could be used for unauthorized access. This involves restricting access to credential storage mechanisms, hardening configurations to block credential dumping methods, and using monitoring tools to detect suspicious credential-related activity. This mitigation can be implemented through the following measures:

Restrict Access to Credential Storage:

  • Use Case: Prevent adversaries from accessing the SAM (Security Account Manager) database on Windows systems.
  • Implementation: Enforce least privilege principles and restrict administrative access to credential stores such as C:\Windows\System32\config\SAM.

Use Credential Guard:

  • Use Case: Isolate LSASS (Local Security Authority Subsystem Service) memory to prevent credential dumping.
  • Implementation: Enable Windows Defender Credential Guard on enterprise endpoints to isolate secrets and protect them from unauthorized access.

Monitor for Credential Dumping Tools:

  • Use Case: Detect and block known tools like Mimikatz or Windows Credential Editor.
  • Implementation: Flag suspicious process behavior related to credential dumping.

Disable Cached Credentials:

  • Use Case: Prevent adversaries from exploiting cached credentials on endpoints.
  • Implementation: Configure group policy to reduce or eliminate the use of cached credentials (e.g., set Interactive logon: Number of previous logons to cache to 0).

Enable Secure Boot and Memory Protections:

  • Use Case: Prevent memory-based attacks used to extract credentials.
  • Implementation: Configure Secure Boot and enforce hardware-based security features like DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization).
Item Value
ID M1043
Version 1.2
Created 11 June 2019
Last Modified 10 December 2024
Navigation Layer View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain ID Name Use
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.008 LSASS Driver On Windows 10 and Server 2016, enable Windows Defender Credential Guard 3 to run lsass.exe in an isolated virtualized environment without any device drivers. 4
enterprise T1601 Modify System Image Some embedded network devices are capable of storing passwords for local accounts in either plain-text or encrypted formats. Ensure that, where available, local passwords are always encrypted, per vendor recommendations. 7
enterprise T1601.001 Patch System Image Some embedded network devices are capable of storing passwords for local accounts in either plain-text or encrypted formats. Ensure that, where available, local passwords are always encrypted, per vendor recommendations. 7
enterprise T1601.002 Downgrade System Image Some embedded network devices are capable of storing passwords for local accounts in either plain-text or encrypted formats. Ensure that, where available, local passwords are always encrypted, per vendor recommendations. 7
enterprise T1599 Network Boundary Bridging Some embedded network devices are capable of storing passwords for local accounts in either plain-text or encrypted formats. Ensure that, where available, local passwords are always encrypted, per vendor recommendations.2
enterprise T1599.001 Network Address Translation Traversal Some embedded network devices are capable of storing passwords for local accounts in either plain-text or encrypted formats. Ensure that, where available, local passwords are always encrypted, per vendor recommendations. 2
enterprise T1003 OS Credential Dumping With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. 5 It also does not protect against all forms of credential dumping. 6
enterprise T1003.001 LSASS Memory With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.56
enterprise T1558 Steal or Forge Kerberos Tickets On Linux systems, protect resources with Security Enhanced Linux (SELinux) by defining entry points, process types, and file labels.1
enterprise T1558.005 Ccache Files Protect resources with Security Enhanced Linux (SELinux) by defining entry points, process types, and file labels.1

References

  1. Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021. ↩↩

  2. Cisco. (n.d.). Cisco IOS Software Integrity Assurance - AAA. Retrieved October 19, 2020. ↩↩

  3. Lich, B., Tobin, J., Hall, J. (2017, April 5). Manage Windows Defender Credential Guard. Retrieved November 27, 2017. ↩

  4. Lich, B., Tobin, J. (2017, April 5). How Windows Defender Credential Guard works. Retrieved November 27, 2017. ↩

  5. Lich, B. (2016, May 31). Protect derived domain credentials with Credential Guard. Retrieved June 1, 2016. ↩↩

  6. NSA IAD. (2017, April 20). Secure Host Baseline - Credential Guard. Retrieved April 25, 2017. ↩↩

  7. Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Credentials Management. Retrieved October 19, 2020. ↩↩↩