T1187 Forced Authentication
Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept that information. MITRE ATT&CK
1 program on CmdID 3 Sigma rules T1187 on attack.mitre.org
Programs for it
Sigma rules tagged with it
highAttempts of Kerberos Coercion Via DNS SPN SpoofingSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highNTLM Hash Leak Via Curl NTLM AuthenticationSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highPotential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URISamir Bousseaden, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows