Red › Module 7 › Lesson 2
Creds Literacy
Credential abuse concepts for defenders and $LAB_RT lab — PtH, tickets, dumps as named literacy, not stranger-domain dump cookbooks.
Visual · t21_creds_literacy
Creds literacy = name abuse classes + blue detections. No mimikatz cookbooks on strangers. Original Cyberlium.
Opening
Blue teams detect credential theft — learn what PtH, Kerberoasting, and DCSync mean, not how to dump every domain you can reach.
Credential access and reuse include password spraying concepts, pass-the-hash, pass-the-ticket, Kerberoasting, DCSync, and LSASS access as ATT&CK-named patterns defenders monitor. Red-team literacy explains what each class means, which logs fire, and how purple exercises test controls on $LAB_RT synthetic accounts — NOT step-by-step credential dump tutorials for stranger AD, NOT running sekurlsa on employer laptops, NOT storing real user hashes from breaches in notes. Lab uses disposable creds per RoE; proof is redacted event IDs and detection gap notes — never exfil real NTLM hashes or krbtgt material from unauthorized forests.
1. Credential classes (literacy)
PtH/PtT reuse existing material; Kerberoasting targets service tickets; DCSync abuses replication — name for ATT&CK mapping.
Defender lens: tiered admin, Protected Users, credential guard, LSASS protections — not attacker dump scripts.
Command guide
Try these commands — Credential classes (literacy)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Credential access literacy — https://attack.mitre.org/tactics/TA0006/ (never dump stranger creds) Valid accounts — https://attack.mitre.org/techniques/T1078/ (lab service accounts only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://attack.mitre.org/tactics/TA0006/ | grep -oE 'T[0-9]{4}' | sort -u | head -8
grep -iE 'never.*cred|dump' "$HOME/cyberlium-lab/t21-rt/roe.txt" 2>/dev/null || echo 'refuse: Mimikatz dumps, stranger domain creds'Primary tools to practice this lesson: curl, grep. Reference sites: Credential access literacy (https://attack.mitre.org/tactics/TA0006/); Valid accounts (https://attack.mitre.org/techniques/T1078/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab-safe practice
Use $LAB_RT disposable accounts and synthetic hashes in brief only — chmod 600 notes, redact before share.
Document 'detection should fire on X' — not archive of real domain creds.
3. Refusal lines
No credential dump cookbooks for stranger domains, no breach paste creds in reports, no spraying real user lists from LinkedIn.
If brief is literacy-only, stop at concept card — do not run dump tools on unauthorized hosts.
4. What you ship: creds literacy card
Three cred abuse classes + defender control each + NO stranger dump cookbooks line.
5. What you record before the next lesson
Creds literacy card path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run domain cred dump tooling against classmate AD because lab brief mentioned PtH.
Right
Name cred classes and defender controls for $LAB_RT. Next: Exfil Boundaries.
Mission: creds literacy card
1) Define PtH and Kerberoasting in one line each. 2) Name two defender controls. 3) Write lab synthetic-cred rule. 4) Write NEVER stranger dump cookbooks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Literacy-only cred module — enough for my RoE?”
Knowledge Check
APPLY: Creds literacy focuses on:
Multiple choice
Knowledge Check
APPLY: True or False: Mimikatz on stranger AD is lab.
True or False
Knowledge Check
APPLY: Defenders reduce cred theft with:
Multiple choice