Techniques › T1110 › T1110.004

T1110.004 Credential Stuffing

credential access — Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0460 Credential Stuffing Detection via Reused Breached Credentials Across Services v1.0
  AN1262 Windows

  Multiple failed authentication attempts using distinct username/password pairs from a single IP address or session within a short time window, targeting common services like RDP or SMB

  WinEventLog:Security EventCode=4625 → DC0002 User Account Authentication

  Tunable: UsernameUniquenessThreshold TimeWindow SourceIPScope
  AN1263 Linux

  Rapid login failures across different users from a single IP address, targeting SSH or PAM login with distinct username-password pairs

  linux:syslog SSH failed login → DC0002 User Account Authentication

  Tunable: LoginFailureRatio AuthServiceFilter
  AN1264 macOS

  Burst of failed authentications with rotating usernames against loginwindow or remote management service using reused breached credentials

  macos:unifiedlog Login failure / authorization denied → DC0002 User Account Authentication

  Tunable: DistinctUsernameCount RemoteAccessFilter
  AN1265 Identity Provider

  Same source IP performing multiple authentication attempts using known breached username/password combinations across different identities in Azure AD, Okta, or Duo

  azure:signinlogs status = failure → DC0002 User Account Authentication

  Tunable: BreachedCredentialSourceMatch SSOServiceScope
  AN1266 SaaS

  Multiple sign-in failures against cloud-based applications using username/password combinations leaked from unrelated domains

  saas-app:auth login_failure → DC0002 User Account Authentication

  Tunable: UserAccountOverlap FailedAttemptsPerIP
  AN1267 Network Devices

  Router/firewall/syslog logs showing authentication failures with unique usernames and reused credentials from same source IP

  networkdevice:syslog AAA, RADIUS, or TACACS authentication → DC0002 User Account Authentication

  Tunable: AuthProtocolFilter FailedAuthBurst
  AN1268 Containers

  Credential stuffing attempts against Kubernetes API or containerized login shells using stolen or leaked user credentials

  kubernetes:apiserver authentication.k8s.io/v1beta1 → DC0002 User Account Authentication

  Tunable: PodAccessScope CredentialSetSize
  AN1269 Office Suite

  Use of leaked credential pairs against Outlook Web Access (OWA), Microsoft 365, or Exchange from a single client IP with multiple failures

  m365:exchange Logon failure → DC0002 User Account Authentication

  Tunable: PasswordSourceMatch MailboxLoginThreshold
  AN1270 IaaS

  Burst of failed login attempts across VM instances using leaked credential pairs from single IP in public cloud environments

  AWS:CloudTrail eventName=ConsoleLogin | eventType=AwsConsoleSignIn → DC0002 User Account Authentication

  Tunable: InstanceIDScope IPBehaviorHistory

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1110.004

Rules tagged at the parent level (attack.t1110) 25

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.