Skip to content
HRM Framework 2.0 , home
Start the assessment

SQ-ATO-02Level 3 · Sequence3 steps in 30 days

Leak to login

A person's credentials appear in a public breach, a spike of malicious login attempts follows, and then a sign-in from an unusual context succeeds, all within 30 days.

View in explorer Suggest a change

Classification

Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
Dimensions Every signal answers one of 3 questions.
Evidence level
Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
ATT&CK tactics
  • Reconnaissance
  • Credential Access
  • Initial Access
NIST CSF 2.0 (from its signals)
  • ID.RA-02
  • DE.CM-03
MITRE ATT&CK (from its signals)
  • T1589
  • T1110.004
  • T1078

The sequence, step by step

SQ-ATO-023 stepsPeak: Stage 4 Suspected

  1. Step 01ATT&CK tactic: Reconnaissance

    Credential leaked

    IA-T-01Credentials leaked in a public breach

    Stage 1Exposed

  2. Step 02ATT&CK tactic: Credential Access

    Failed-login spike

    IA-T-04Targeted by malicious login attempts

    Stage 1Exposed

  3. Step 03ATT&CK tactic: Initial Access

    Unusual successful login

    IA-B-04Signs in from unusual contexts

    Stage 4Suspected

  4. Breach scenarioHB-02

    Credential abuse & account takeover

    Inside 30 days

Leak to login, 3 steps inside 30 days: Credential leaked (IA-T-01 Credentials leaked in a public breach, Reconnaissance, Stage 1 Exposed); then Failed-login spike (IA-T-04 Targeted by malicious login attempts, Credential Access, Stage 1 Exposed); then Unusual successful login (IA-B-04 Signs in from unusual contexts, Initial Access, Stage 4 Suspected). It leads to HB-02 Credential abuse & account takeover.

A completed sequence is evidence that its steps happened in order inside 30 days: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.

The definition, in detail

Definition

The leak and the attempts keep the person at Stage 1; the successful unusual sign-in completes the sequence at Stage 4.

Example

A contractor's password appeared in a combolist on the 2nd, the identity provider logged a burst of failed logins on the 9th, and a successful login from a residential proxy landed on the 20th.

The steps

3 steps, in order.

  1. Credential leaked

    IA-T-01 Credentials leaked in a public breach

    ATT&CK tactic: Reconnaissance · Stage 1 Exposed

  2. Failed-login spike

    IA-T-04 Targeted by malicious login attempts

    ATT&CK tactic: Credential Access · Stage 1 Exposed

  3. Unusual successful login

    IA-B-04 Signs in from unusual contexts

    ATT&CK tactic: Initial Access · Stage 4 Suspected

How it is measured

Steps
3
Window
30 days
Sources
Breach & dark-web exposure, Identity provider & MFA

How it is used

Programs watch the 3 steps in order inside 30 days; a completed run moves the person to Stage 4 Suspected and points at Credential abuse & account takeover.

A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.

Continue exploring

Cite this term

"Leak to login" (SQ-ATO-02), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-ato-02-leak-to-login

Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.

Same breach scenario

3 other sequences end in Credential abuse & account takeover.

HB-02 Credential abuse & account takeover: every sequence, cohort and signal that points to it.

  • SQ-ATO-015 steps · 72 hours

    Phish to takeover

    1. Step 1: Real phish delivered (SE-T-02 Real phishing delivered to inbox)
    2. Step 2: Link clicked (SE-B-04 Clicks links in real phishing)
    3. Step 3: Unusual login (IA-B-04 Signs in from unusual contexts)
    4. Step 4: New MFA device (IA-B-05 Approves MFA after repeated prompts)
    5. Step 5: Malicious mail sent from the account (SE-T-06 Account sending malicious or phishing mail)
    6. Breach scenario: HB-02 Credential abuse & account takeover

  • SQ-ATO-033 steps · 24 hours

    MFA fatigue

    1. Step 1: Repeated MFA prompts (IA-T-04 Targeted by malicious login attempts)
    2. Step 2: Odd-hour approval (IA-B-05 Approves MFA after repeated prompts)
    3. Step 3: New factor registered (IA-B-05 Approves MFA after repeated prompts)
    4. Breach scenario: HB-02 Credential abuse & account takeover

  • SQ-ATO-044 steps · 24 hours

    Help-desk takeover

    1. Step 1: Voice pretext (SE-T-04 Receives callback or voice phishing)
    2. Step 2: MFA reset ticket (SE-A-03 Can reset passwords or MFA for others)
    3. Step 3: New device (IA-B-05 Approves MFA after repeated prompts)
    4. Step 4: Admin login (IA-A-01 Holds admin or privileged roles)
    5. Breach scenario: HB-02 Credential abuse & account takeover

The initial assessment

Find your level.Then fix what matters.

18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.

Start the assessment Explore the taxonomy

Suggest a change

What kind of change?

Only if you would like a reply. See the privacy notice.

 Feedback
Start the assessment