Benchmark: TA0006 Credential Access
Overview
The adversary is trying to steal account names and passwords.
Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/tailpipe-mod-github-audit-log-detectionsStart the Powerpipe server:
powerpipe serverOpen http://localhost:9033 in your browser and select TA0006 Credential Access.
Run this benchmark in your terminal:
powerpipe benchmark run github_audit_log_detections.benchmark.mitre_attack_v161_ta0006Snapshot and share results via Turbot Pipes:
powerpipe benchmark run github_audit_log_detections.benchmark.mitre_attack_v161_ta0006 --share