ConceptsCredential Access Hunts

Credential Access Hunts

Threat hunts focused on finding signs of credential theft that detections missed, searching telemetry for behaviors like memory access to credential stores, suspicious authentication, or tools associated with harvesting credentials.

Glossary definition

7 direct links1 lesson

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Hunt Hypothesis

The foundation Credential Access Hunts builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Hunt HypothesisStart here

A specific, testable statement of what malicious activity might be present and how it would show up in data, that drives a threat hunt, giving it a clear question to investigate rather than aimless searching.

lessons

Relatedsorted by lesson coverage

Frequency Analysis

lessons

Credential Access

lessons

Credential Dumping

lesson

Defense Evasion Hunts

lesson

Initial Access Hunts

lesson

Lateral Movement Hunts

lesson

Related Lessons

1 lesson covers this concept

Use Intelligence and ATT&CK Carefully

SOC Analyst