- T1003.001 LSASS Memory
- T1110 Brute Force
- T1110.001 Password Guessing
- T1110.003 Password Spraying
- T1552.001 Credentials In Files
- T1558.003 Kerberoasting
- T1003 OS Credential Dumping (index only)
- T1003.002 Security Account Manager (index only)
- T1003.003 NTDS (index only)
- T1003.004 LSA Secrets (index only)
- T1003.005 Cached Domain Credentials (index only)
- T1003.006 DCSync (index only)
- T1003.007 Proc Filesystem (index only)
- T1003.008 /etc/passwd and /etc/shadow (index only)
- T1040 Network Sniffing (index only)
- T1056 Input Capture (index only)
- T1056.001 Keylogging (index only)
- T1056.002 GUI Input Capture (index only)
- T1056.003 Web Portal Capture (index only)
- T1056.004 Credential API Hooking (index only)
- T1110.002 Password Cracking (index only)
- T1110.004 Credential Stuffing (index only)
- T1111 Multi-Factor Authentication Interception (index only)
- T1187 Forced Authentication (index only)
- T1212 Exploitation for Credential Access (index only)
- T1528 Steal Application Access Token (index only)
- T1539 Steal Web Session Cookie (index only)
- T1552 Unsecured Credentials (index only)
- T1552.002 Credentials in Registry (index only)
- T1552.003 Shell History (index only)
- T1552.004 Private Keys (index only)
- T1552.005 Cloud Instance Metadata API (index only)
- T1552.006 Group Policy Preferences (index only)
- T1552.007 Container API (index only)
- T1552.008 Chat Messages (index only)
- T1555 Credentials from Password Stores (index only)
- T1555.001 Keychain (index only)
- T1555.002 Securityd Memory (index only)
- T1555.003 Credentials from Web Browsers (index only)
- T1555.004 Windows Credential Manager (index only)
- T1555.005 Password Managers (index only)
- T1555.006 Cloud Secrets Management Stores (index only)
- T1556 Modify Authentication Process (index only)
- T1556.001 Domain Controller Authentication (index only)
- T1556.002 Password Filter DLL (index only)
- T1556.003 Pluggable Authentication Modules (index only)
- T1556.004 Network Device Authentication (index only)
- T1556.005 Reversible Encryption (index only)
- T1556.006 Multi-Factor Authentication (index only)
- T1556.007 Hybrid Identity (index only)
- T1556.008 Network Provider DLL (index only)
- T1556.009 Conditional Access Policies (index only)
- T1557 Adversary-in-the-Middle (index only)
- T1557.001 Name Resolution Poisoning and SMB Relay (index only)
- T1557.002 ARP Cache Poisoning (index only)
- T1557.003 DHCP Spoofing (index only)
- T1557.004 Evil Twin (index only)
- T1558 Steal or Forge Kerberos Tickets (index only)
- T1558.001 Golden Ticket (index only)
- T1558.002 Silver Ticket (index only)
- T1558.004 AS-REP Roasting (index only)
- T1558.005 Ccache Files (index only)
- T1606 Forge Web Credentials (index only)
- T1606.001 Web Cookies (index only)
- T1606.002 SAML Tokens (index only)
- T1621 Multi-Factor Authentication Request Generation (index only)
- T1649 Steal or Forge Authentication Certificates (index only)