Full Report
What is credential theft? Learn how threat actors use phishing, brute force, and tools like Mimikatz or Registry hive dumps to gain initial access and move laterally.
Analysis Summary
# Best Practices: Credential Theft Prevention & Post-Exploitation Defense
## Overview
These practices address the lifecycle of credential theft—from initial access (phishing, brute force, SEO poisoning) to post-exploitation activities where attackers harvest local credentials (via Mimikatz or Registry dumps) to move laterally across a network.
## Key Recommendations
### Immediate Actions
1. **Disable Public-Facing Management Ports:** Immediately close RDP (3389) and MSSQL (1433) ports to the public internet. Use a VPN or Zero Trust Network Access (ZTNA) for remote management.
2. **Audit Account Privileges:** Identify and disable the built-in Windows **Guest account** and rename or disable the default Administrator account to thwart automated brute-force scripts.
3. **Deploy MFA:** Implement Multi-Factor Authentication (MFA) across all external-facing applications and VPNs to neutralize stolen credentials.
4. **Endpoint Protection:** Ensure EDR (Endpoint Detection and Response) is active to detect "infostealers" and unauthorized tools like Mimikatz.
### Short-term Improvements (1-3 months)
1. **Attack Surface Reduction (ASR):** Perform a full asset inventory to identify "hidden" attack surfaces, such as forgotten web applications (e.g., FOUNDATION or mJobTime) vulnerable to SQL injection.
2. **Credential Guard Implementation:** Enable Windows Defender Credential Guard to protect LSASS (Local Security Authority Subsystem Service) from memory dumping.
3. **Log Management:** Configure centralized logging for authentication events. Specifically, monitor for high frequencies of failed logins (Event ID 4625) and successful logins followed by immediate administrative tool usage.
### Long-term Strategy (3+ months)
1. **Tiered Administration Model:** Implement a "Tier 0/1/2" model where domain admin credentials are never used to log into lower-security workstations, preventing credential caching in high-risk areas.
2. **Session Management:** Implement session timeouts and token revocation policies to defend against session hijacking and token theft.
3. **Application Whitelisting:** Move toward a "deny-by-default" posture for executable files to prevent users from accidentally installing malware packaged with legitimate tools (SEO poisoning defense).
---
## Implementation Guidance
### For Small Organizations
* **Focus:** Asset visibility and basic hygiene.
* **Action:** Ensure all software is updated to patch SQL injection vulnerabilities. Use a password manager to encourage complex, unique passwords that resist brute-forcing.
### For Medium Organizations
* **Focus:** Detection and monitoring.
* **Action:** Deploy a Managed EDR service to monitor for lateral movement techniques like "Pass-the-Hash." Focus on securing the "initial access broker" entry points.
### For Large Enterprises
* **Focus:** Segmentation and Identity Isolation.
* **Action:** Implement Micro-segmentation to limit lateral movement. Use Privileged Access Management (PAM) solutions to provide "Just-in-Time" access, ensuring credentials aren't stored persistently on endpoints.
---
## Configuration Examples
### Registry Hardening (Protecting Hives)
Attackers often dump the SAM and SYSTEM registry hives to crack passwords offline. Ensure permissions are restricted:
* **Action:** Monitor for `reg.exe save hklm\sam` or `reg.exe save hklm\system` commands in command-line logs.
### SQL Server Hardening
* **Action:** Disable `xp_cmdshell` to prevent a SQL injection vulnerability from escalating into full OS-level Remote Code Execution (RCE).
---
## Compliance Alignment
* **NIST SP 800-63B:** Guidelines for Authentication and Lifecycle Management.
* **CIS Control 5 & 6:** Account Management and Access Control Management.
* **ISO/IEC 27001:** Annex A.9 (Access Control).
---
## Common Pitfalls to Avoid
* **Ignoring Service Accounts:** Often, service accounts have weak passwords and high privileges, making them prime targets for brute force.
* **Default Configurations:** Assuming software (like accounting packages) is secure out of the box. Always audit default credentials.
* **Shadow IT:** Failing to account for web-facing apps installed by departments outside of IT, which creates a "hidden attack surface."
---
## Resources
* **Huntress Blog:** hxxps[://]www[.]huntress[.]com/blog (Tradecraft updates)
* **MITRE ATT&CK Framework:** T1003 (OS Credential Dumping)
* **Microsoft Documentation:** Protecting LSASS with PPL (Protected Process Light)
* **Tooling:** Managed EDR (Huntress), BloodHound (for mapping lateral movement paths)