Introduction
In September 2024, the Scattered Spider (UNC3944) cluster leveraged thousands of credentials harvested from infostealer logs to bypass MFA on Okta tenants belonging to multiple major organizations, initiating a wave of ransomware attacks deployed via legitimate VPN access. This incident is not anomalous — it is the prevailing attack pattern. Credential leak detection is no longer a reactive hygiene function; it is the primary detection layer for the most common initial access vector in modern cyberattacks. The MITRE ATT&CK framework catalogues this attack path across multiple overlapping techniques, and understanding this coverage is essential for any SOC, IAM, or threat intelligence team building a detection program around credential exposure.
This article maps the specific MITRE ATT&CK techniques that begin with a leaked credential, explains how threat actors operationalise exposed credentials through infostealer malware and dark web credential markets, and provides a detection framework grounded in real-time credential leak monitoring. It is written for CISOs evaluating detection gaps, SOC analysts building alert logic, and intelligence teams who need to understand how credential leaks map to adversary behaviour in the ATT&CK matrix.
The MITRE ATT&CK Framework and Leaked Credentials
MITRE ATT&CK categorises adversary behaviour across the attack lifecycle from initial access through exfiltration and impact. Leaked credentials directly enable multiple initial access techniques and sit at the intersection of resource development, initial access, credential access, and persistence. Understanding which specific techniques involve leaked credentials allows security teams to prioritise credential leak detection as a control that addresses not one technique but an entire cluster of high-frequency adversary behaviours.
Which MITRE ATT&CK Techniques Begin with a Leaked Credential?
The single most relevant technique is T1078 Valid Accounts, and within that, the specific sub-technique T1078.001 Default Accounts and T1078.002 Domain Accounts. When an adversary acquires a valid username and password combo from an infostealer log dump or combo list, they possess a T1078-capable asset. They do not need to exploit a vulnerability — they authenticate. This is the core reason credential leak detection is a critical detection control: it addresses the technique security teams find hardest to detect because the traffic appears legitimate.
- T1078 Valid Accounts (Sub-techniques .001–.004): Adversaries use stolen credentials to authenticate to systems. The credential may come from infostealer malware logs, dark web credential markets, or targeted phishing. Detection requires monitoring credential exposure on the dark web before the account is used maliciously.
- T1589 Gather Victim Identity Information (Sub-techniques .001–.003): Adversaries collect credentials, email addresses, and employee names from credential leaks. This technique feeds directly into targeted phishing and credential stuffing. Combo lists sold on forums like Russian Market or 2easy Market directly enable this step.
- T1586 Compromise Accounts: Before launching a broader attack, adversaries often compromise legitimate accounts to establish credibility or access internal resources. Leaked credentials from one service are used to pivot to another.
- T1650 Acquire Access: This technique covers the brokerage of access — selling VPN credentials, RDP access, or cloud console accounts obtained from credential leaks. Initial access brokers (IABs) on Exploit.in and BreachForums specialise in this.
Why Credential Leak Detection Is the Detection Control for T1078
For T1078 Valid Accounts, traditional detection controls like brute-force detection fail because the login is legitimate — the password is correct. MFA can be bypassed through token theft, session hijacking, or AITM phishing. Credential leak detection addresses this gap by identifying that the credential is exposed before it is used. When a domain account appears in an infostealer log dump or a combo list, the organisation can force a password reset or revoke the session before the adversary authenticates. This is detection-prevention at the resource development stage of the attack lifecycle.
The Verizon 2024 Data Breach Investigations Report (DBIR) found that compromised credentials were the primary attack vector in over 60% of all data breaches, and 85% of web application breaches involved credential theft or misuse. This makes T1078 the single most prevalent initial access technique in the current threat landscape.
Infostealer Logs and the ATT&CK Resource Development Phase
Infostealer malware families like RedLine Stealer, Lumma Stealer, Vidar, Raccoon Stealer, and RisePro are the primary mechanisms by which credentials are harvested at scale. These malware families extract stored credentials from browsers, FTP clients, VPN applications, password managers, email clients, and cryptocurrency wallets. The resulting log files are aggregated, deduplicated, and sold on markets like Genesis Market (taken down by law enforcement but succeeded by similar operations), Russian Market, and Telegram channels dedicated to credential selling.
From a MITRE ATT&CK perspective, infostealer deployment corresponds to T1555 Credentials from Password Stores and T1056 Input Capture, but the output — the stolen credential — feeds directly into T1589.003 Gather Victim Identity Information: Credentials. The malware itself is a tool for resource development, acquiring the raw material for later attacks.
What Is the Difference Between a Credential Leak and an Infostealer Log?
A credential leak is any exposure of authentication credentials — passwords, session tokens, API keys — to unauthorised parties. This can happen through data breaches, phishing, credential stuffing, or infostealer infection. An infostealer log is a specific type of credential leak: a structured file output by stealer malware containing harvested credentials, often including the URL, username, password, and sometimes browser fingerprint and geolocation data. Infostealer logs are more immediately weaponisable because they are parsed and organised for credential stuffing or direct use. Credential leak detection that includes infostealer log ingestion is therefore the more specific and actionable sub-discipline for addressing T1589 and T1078.
- Broader detection scope: A credential leak detection platform must monitor paste sites, dark web forums, Telegram channels, combo lists, and marketplace listings — not just infostealer logs.
- Higher signal-to-noise from logs: Infostealer logs provide validated, timestamped credentials with the associated URL, making them immediately actionable for a password reset or account review.
- Combo lists as a derivative risk: Combo lists aggregate credentials from multiple breaches and logs. Monitoring combo list emergence on forums like XSS.is or Exploit.in is a leading indicator that a specific credential set is circulating.
How Adversaries Use Infostealer Logs to Attack: From T1589 to T1078
The attack path is well-documented and follows a predictable sequence. An adversary acquires an infostealer log dump containing 100,000+ credential pairs across multiple domains. They parse the logs for high-value targets — enterprise VPN portals, cloud console logins, financial services platforms, healthcare portals. These credentials are tested against the legitimate login endpoints using password stuffing tools (OpenBullet, Selenium-based bots). Once a working credential is confirmed, it is either used directly for access (T1078) or sold to an initial access broker (T1650) on a dark web forum. The entire cycle from log dump to active access can take less than 48 hours.
CrowdStrike's 2025 Global Threat Report identified a 300% increase in eCrime attacks linked to initial access brokers trading credentials obtained from infostealer malware. The report specifically named Lumma Stealer and RedLine Stealer as the leading sources of credential logs sold on Russian Market and Telegram.
Beyond Initial Access: Persistence and Privilege Escalation via Leaked Credentials
Leaked credentials do not stop enabling adversary behaviour after initial access. In the MITRE ATT&CK matrix, they also support persistence and privilege escalation techniques. If an adversary obtains a legitimate credential for a service account, a domain admin account, or a cloud admin role, they can maintain access through legitimate authentication indefinitely — no malware required, no persistence mechanism to detect.
How Leaked Credentials Enable Persistence (T1098, T1136, T1556)
With a valid credential, an adversary can create their own accounts (T1136.003 Cloud Account), modify authentication processes (T1556.003 Install Web Shell or T1556.006 MFA Manipulation), or modify existing account attributes (T1098 Account Manipulation). The 2023 Okta support system breach — where attackers used a stolen service account credential to access Okta's customer support systems — is a textbook example of T1078 enabling T1136 and T1098 for long-term access. Credential leak detection that identifies the service account exposure before the adversary uses it would have cut this attack at the resource development phase.
- T1098 Account Manipulation: Attackers add MFA devices, modify email forwarding rules, or grant additional permissions to an account they have accessed via a stolen credential.
- T1136.003 Create Account: Cloud Account: Using a compromised cloud admin credential, an attacker creates a new IAM user with high privileges. This user is legitimate from the cloud provider's perspective.
- T1556.006 Modify Authentication Process: MFA Manipulation: Attackers with a compromised administrative credential can deregister legitimate MFA devices and register their own, effectively bypassing MFA permanently.
Privilege Escalation via Exposed Credentials (T1078.002, T1068)
When a credential is exposed at a privileged level — a domain admin password in a Lumma Stealer log, a root AWS access key in a GitHub leak — the adversary can escalate privilege without exploiting any vulnerability. This is pure T1078.002 Domain Accounts or T1078.004 Cloud Accounts. Even if the initial credential is for a standard user, if that user has been assigned a role that allows privilege escalation (a common misconfiguration), the adversary moves through T1068 Exploitation for Privilege Escalation by leveraging the access the credential provides.
Mandiant M-Trends 2024 reported that the median dwell time for attacks using compromised credentials was 16 days, compared to 31 days for malware-based intrusions. The lower dwell time reflects the speed with which attackers move once they have legitimate authentication, bypassing many traditional detection controls.
Detection Approach: Building Alerts Around T1589 and T1078
Detecting credential leak-driven attacks requires shifting left in the kill chain — monitoring for credential exposure on the dark web, infostealer logs, and credential markets before the adversary authenticates. This is not a SIEM use case, though the alerts should feed into the SIEM. It is an external intelligence collection and monitoring discipline that produces detection signals that no internal sensor can generate.
How to Build an Alert Correlation Between Credential Leaks and Authentication Logs
The most effective detection approach correlates a credential leak detection alert with subsequent authentication events. When credential leak monitoring (the external intelligence source) identifies that a user's credential is exposed, and the authentication log (the internal data source) shows a successful login from that account in the subsequent 24–72 hours, the probability of a T1078-driven attack is high. This correlation works best when the credential leak detection platform provides a timestamp for when the log was published, allowing temporal correlation with authentication events that occurred after the publication date.
What Is the Role of Credential Leak Detection in a SIEM Integration?
Credential leak detection feeds a high-fidelity indicator set into the SIEM. The SIEM receives a "credential exposed" alert for a specific user email or username, mapped to a custom MITRE ATT&CK tag (T1589.003 or T1078). The SOC analyst can then pivot to authentication logs for that user, check for recent successful logins from unusual geographies or IPs, and trigger a password reset. Without the credential leak detection signal, the authentication events appear entirely normal. This integration elevates credential leak detection from a passive monitoring function to an active detection control that directly addresses T1078 detection gaps.
IBM's Cost of a Data Breach Report 2024 found that organisations using threat intelligence platforms integrated with their SIEM reduced the average cost of a breach by USD 1.5 million. Credential leak detection as an intelligence feed into the SIEM directly contributes to this cost reduction by shortening dwell time.
How DarkThreat.AI Maps to MITRE ATT&CK for Credential Leak Detection
DarkThreat.AI's credential leak detection capability is designed to monitor and ingest the specific data sources that adversaries use in the T1589 and T1078 attack paths. The platform provides real-time crawls of infostealer log dump collections on Telegram channels, dark web markets including Russian Market and 2easy Market, forum threads on XSS.is and Exploit.in, and paste sites where combo lists are posted. Each credential exposure is enriched with the source, publication timestamp, and severity score that maps to the credential's role — user, privileged user, service account, or domain admin.
For SOC teams building MITRE ATT&CK-aligned detection logic, DarkThreat.AI outputs alerts structured for SIEM ingestion with ATT&CK technique tagging. An alert for a domain admin credential appearing in a RedLine Stealer log dump is tagged T1078.002, providing immediate context for the analyst. The platform also supports domain-wide credential monitoring — scanning all exposed credentials across all monitored sources for any email address associated with the organisation's domain, ensuring no credential exposure goes unmonitored regardless of which employee or system it belongs to.
Related Resources
- What Is Credential Leak Detection? A Complete Guide for 2025 — Establishes the foundational concept and operational framework for credential leak monitoring as a security control.
- Leaked Credentials as Initial Access: MITRE ATT&CK Coverage — Directly maps the credential leak detection capability to the specific ATT&CK techniques discussed in this article.
- Stealer Logs and Dark Web Monitoring: The Connection — Explains how infostealer malware logs flow into dark web markets and how monitoring captures this resource development activity.
- Credential Stuffing Attacks: How Stolen Passwords Are Used — Covers the T1110 Brute Force side of credential misuse and how credential leak detection prevents credential stuffing attacks before they begin.
Conclusion
Leaked credentials are the most direct path from criminal intent to network access, enabling T1078 Valid Accounts and the full cascade of subsequent attack techniques from persistence to ransomware deployment. Effective credential leak detection addresses this attack path at the resource development stage — before the adversary authenticates — by monitoring the dark web, infostealer logs, and credential markets where the raw material of these attacks originates. For SOC teams building MITRE ATT&CK-aligned detection programs, credential leak monitoring is not a secondary data source; it is the primary detection layer for the highest-frequency initial access technique in the current threat landscape.
As infostealer malware families evolve and initial access broker markets mature, credential leak detection will become as fundamental to the detection stack as endpoint detection and network monitoring. Platforms like DarkThreat.AI that provide real-time credential exposure monitoring across dark web sources, with direct SIEM integration and ATT&CK mapping, represent the detection architecture required to stay ahead of adversaries who have made credential theft their primary attack enabler. The credential is the gateway — monitoring its exposure is how you lock the gate before they pass through.
