Credentials
Subtechnique · ATTACK:enterprise:T1589.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1589.001",
"title": "Credentials",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1589/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--bc76d0a4-db11-4551-9ac4-01a469cfb161",
"external_id": "T1589.001",
"domain": "enterprise",
"created": "2020-10-02T14:55:43.815Z",
"modified": "2025-10-24T17:49:18.246Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"reconnaissance"
],
"source_references": [
{
"source_name": "Bleeping Computer 2easy 2021",
"url": "https://www.bleepingcomputer.com/news/security/2easy-now-a-significant-dark-web-marketplace-for-stolen-data/"
},
{
"source_name": "ATT ScanBox",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
},
{
"source_name": "Detectify Slack Tokens",
"url": "https://labs.detectify.com/writeups/slack-bot-token-leakage-exposing-business-critical-information/"
},
{
"source_name": "GitHub truffleHog",
"url": "https://github.com/dxa4481/truffleHog"
},
{
"source_name": "Bleeping Computer Stealer Logs 2023",
"url": "https://www.bleepingcomputer.com/news/security/dissecting-the-dark-web-supply-chain-stealer-logs-in-context/"
},
{
"source_name": "Register Uber",
"url": "https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/"
},
{
"source_name": "GitHub Gitrob",
"url": "https://github.com/michenriksen/gitrob"
},
{
"source_name": "CNET Leaks",
"url": "https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/"
},
{
"source_name": "Okta Scatter Swine 2022",
"url": "https://sec.okta.com/scatterswine"
},
{
"source_name": "Forbes GitHub Creds",
"url": "https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196"
},
{
"source_name": "SecureWorks Infostealers 2023",
"url": "https://www.secureworks.com/research/the-growing-threat-from-infostealers"
},
{
"source_name": "Register Deloitte",
"url": "https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05f6442b-1ba8-4356-9e3a-17edc6236a10
Microsoft Targeting Elections September 2020ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--078fb58f-0b5b-4021-8467-800893c35d08
Microsoft Iranian Threat Actor Trends November 2021 · IBM ITG18 2020ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1dc273bd-fb9d-4a36-a234-37ec11238e26
ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2de94367-a058-4a31-b19b-fddebe02ca64
CISA AA21-200A APT40 July 2021ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68b21708-d862-42ba-8067-7fdca0bd1455
CrowdStrike StellarParticle January 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a30f4d65-bb33-4c5f-b278-e8ec73de5bb1
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2ac3384-00db-49f0-bf3b-6c545c1b91e0
Intel471_SH_Aug2021 · Unit42KelleyVaya_BlingLibra_Aug2024ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ddc692ea-33e8-493d-a5e3-ce0de48da15c
NCC Group Chimera January 2021ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0d494d7-f081-4195-92c6-95aae2f2cadc
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:T1589.001 → subtechnique-of → ATTACK:enterprise:T1589
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1b32781-5cc4-40b3-a9b9-af069657665a