HB-02Level 4 · Breach scenarioDBIR: Basic Web Application Attacks · VERIS: Hacking
Credential abuse & account takeover
- Level 4 · Breach scenario
- 46 signals
- 6 risk domains
A breach in which an attacker signs in as a legitimate person using stolen, leaked, guessed or phished credentials, or by defeating MFA.
Classification
- Fed by risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Anchor
-
- DBIR: Basic Web Application Attacks · VERIS: Hacking
- NIST CSF 2.0
-
- PR.AA-01
- PR.AA-03
- MITRE ATT&CK
-
- T1078
- T1110.004
- T1621
- T1098.005
-
4
Sequences
End in this breach scenario.
-
7
Cohorts
Predict it.
-
46
Signals
Feed it.
-
6
Risk domains
Where those signals come from.
Sequences that lead here
4 sequences end here.
Each one is a set of signals in order inside a window. Choose one to watch it play.
SQ-ATO-015 stepsPeak: Stage 4 Suspected
Phish to takeover
Step 01ATT&CK tactic: Initial Access
Real phish delivered
SE-T-02Real phishing delivered to inbox
Stage 1Exposed
Step 04ATT&CK tactic: Persistence
New MFA device
IA-B-05Approves MFA after repeated prompts
Stage 4Suspected
Step 05ATT&CK tactic: Lateral Movement
Malicious mail sent from the account
SE-T-06Account sending malicious or phishing mail
Stage 4Suspected
Phish to takeover, 5 steps inside 72 hours: Real phish delivered (SE-T-02 Real phishing delivered to inbox, Initial Access, Stage 1 Exposed); then Link clicked (SE-B-04 Clicks links in real phishing, Execution, Stage 3 Exploited); then Unusual login (IA-B-04 Signs in from unusual contexts, Persistence, Stage 4 Suspected); then New MFA device (IA-B-05 Approves MFA after repeated prompts, Persistence, Stage 4 Suspected); then Malicious mail sent from the account (SE-T-06 Account sending malicious or phishing mail, Lateral Movement, Stage 4 Suspected). It leads to HB-02 Credential abuse & account takeover.
-
SQ-ATO-01
Phish to takeover
- Step 1: Real phish delivered (SE-T-02 Real phishing delivered to inbox)
- Step 2: Link clicked (SE-B-04 Clicks links in real phishing)
- Step 3: Unusual login (IA-B-04 Signs in from unusual contexts)
- Step 4: New MFA device (IA-B-05 Approves MFA after repeated prompts)
- Step 5: Malicious mail sent from the account (SE-T-06 Account sending malicious or phishing mail)
- Breach scenario: HB-02 Credential abuse & account takeover
-
SQ-ATO-02
Leak to login
- Step 1: Credential leaked (IA-T-01 Credentials leaked in a public breach)
- Step 2: Failed-login spike (IA-T-04 Targeted by malicious login attempts)
- Step 3: Unusual successful login (IA-B-04 Signs in from unusual contexts)
- Breach scenario: HB-02 Credential abuse & account takeover
-
SQ-ATO-03
MFA fatigue
- Step 1: Repeated MFA prompts (IA-T-04 Targeted by malicious login attempts)
- Step 2: Odd-hour approval (IA-B-05 Approves MFA after repeated prompts)
- Step 3: New factor registered (IA-B-05 Approves MFA after repeated prompts)
- Breach scenario: HB-02 Credential abuse & account takeover
-
SQ-ATO-04
Help-desk takeover
- Step 1: Voice pretext (SE-T-04 Receives callback or voice phishing)
- Step 2: MFA reset ticket (SE-A-03 Can reset passwords or MFA for others)
- Step 3: New device (IA-B-05 Approves MFA after repeated prompts)
- Step 4: Admin login (IA-A-01 Holds admin or privileged roles)
- Breach scenario: HB-02 Credential abuse & account takeover
The definition, in detail
Definition
It is the Basic Web Application Attacks pattern in the Verizon DBIR and the Hacking action in VERIS, and four of the eleven sequences in this model end in it.
Example
A leaked password and an approved push prompt give an attacker a working mailbox; the attacker adds a forwarding rule and sends invoices to customers.
How it is measured
- Anchor
- DBIR: Basic Web Application Attacks · VERIS: Hacking
- SOC signals
- Account compromise, suspicious sign-in
- Fed by
- 46 signals across 6 risk domains
How it is used
Programs measure toward Credential abuse & account takeover by counting the 46 signals, 7 cohorts and 4 sequences that point to it, and tie them to the incidents the SOC records as account compromise, suspicious sign-in.
A breach scenario names what the evidence beneath it points toward. The organization’s own incidents confirm it; the signals, cohorts and sequences show where it is likely.
Technical mappings
Framework mappings; validate for your use case.
Continue exploring
"Credential abuse & account takeover" (HB-02), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/breach-scenarios/hb-02-credential-abuse-and-account-takeover
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one breach scenario.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.