Leafminer

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Cit

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web bro

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different creden

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users,

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate priv

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credent

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Later

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

[LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modul

MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel,

[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT