Compromised Identity (Dictionary Entry)

Contexts	IAM, Information Security
Term	Compromised Identity
Alternative Forms	Compromised Account Compromised Credential Compromised Identity
Definitions	An identity whose credentials are no longer reliable because they have been exposed. It may or may not have been exploited by an unauthorized entity, or its exploitation status may be unknown. But it is suspected of being exploitable with higher probability because of the exposure of its credentials.
Examples	When the password credential of an identity has been leaked, the identity has been compromised. This is independent of the fact that an unauthorized entity has exploited the leaked password to gain unauthorized access to resources. Later on, if an unauthorized entity uses the leaked password to bypass access controls, the identity and the accessed resources become exploited.
Related Terms	Account Credential `Component` Credential Theft (Dictionary Entry) Exploited Identity (Dictionary Entry) Identity

Quotes

Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access.

(MITRE, T1078, 2019)

Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

(MITRE, T1078, 2019)

Bibliography

MITRE, T1078, 2019

Compromised Identity (Dictionary Entry)

Quotes

Bibliography

See Also