Home/ MITRE Matrix/ Credential Access/ T1212

T1212Exploitation for Credential Access

T1212 — Exploitation for Credential Access is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 9 detection use cases covering it and 5 threat-intel articles citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

9Use cases

5Articles

0Sub-techniques

1Tactic

Use cases covering this technique (9)

Kubernetes Nginx Ingress LFI ESCU actions · alerting P Kubernetes Nginx Ingress RFI ESCU actions · alerting P Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script ESCU actions · alerting P Splunk Low Privilege User Can View Hashed Splunk Password ESCU actions · hunting P [LLM] EnvoyExtensionPolicy Lua with double-slash path traversal to secrets (CVE-2026-53713) Bespoke exploit · alerting SΣPDD [LLM] Better Auth OAuth refresh_token grant replayed without client_secret (CVE-2026-53512) Bespoke exploit · alerting SP [LLM] GitHub Actions Runner.Worker memory read via /proc/<pid>/mem (CI secret unmasking) Bespoke actions · alerting DSΣPDDCS [LLM] Process reading /proc/<pid>/mem of GitHub Actions Runner.Worker (in-memory secret extraction) Bespoke actions · alerting DSΣPDDCS [LLM] Runner.Worker process memory dumped via /proc/PID/mem read on Linux runner Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (5)

crit [GHSA / CRITICAL] CVE-2026-53713: Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secr art-149

crit [GHSA / CRITICAL] CVE-2026-53513: @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints art-224

high Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised art-274

high Multiple redhat-cloud-services npm Packages compromised art-370

crit Reconstructing the TJ Actions Changed Files GitHub Actions Compromise art-1020