CmdID

CmdID / Techniques

T1212 Exploitation for Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials. MITRE ATT&CK

1 Sigma rule T1212 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first
highSuspicious NTLM Authentication on the Printer Spooler ServiceElastic (idea), Tobias Michalski (Nextron Systems) · Windows