CAPEC-652 Use of Known Kerberos Credentials

abstraction: standardstatus: active

An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.

likelihood: Mediumseverity: High

weaknesses (9)

The CWE weakness classes this flaw belongs to.

CWE-262Not Using Password Aging
CWE-263Password Aging with Long Expiration
CWE-294Authentication Bypass by Capture-replay
CWE-307Improper Restriction of Excessive Authentication Attempts
CWE-308Use of Single-factor Authentication
CWE-309Use of Password System for Primary Authentication
CWE-522Insufficiently Protected Credentials
CWE-654Reliance on a Single Factor in a Security Decision
CWE-836Use of Password Hash Instead of Password for Authentication

ATT&CK techniques

ATT&CK techniques this enables or maps to.

T1558Steal or Forge Kerberos Tickets

related attack patterns (3)

Related entries.

CAPEC-509Kerberoasting
CAPEC-560Use of Known Domain Credentials
CAPEC-645Use of Captured Tickets (Pass The Ticket)

source

Where this definition is published.

MITRE CAPEC