coldbraid

Forced Authentication T1187

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept that information. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and…

Tactics
Credential Access
Actors using it
2
Sub-techniques
0

Ransomware groups reported using it

thegentlemen

Threat actors

MITRE ATT&CKTechnique matrix