Domain credentials are authentication details-such as usernames, passwords, or reusable authentication material-used to access accounts managed by an organization’s directory service. When they belong to privileged accounts, they can grant broad access to systems, users, and administrative functions.
Attackers may seek these credentials after gaining an initial foothold, including through a compromised VPN or other remote-access system. Reusing stolen credentials can let them move through a network or escalate their access without deploying additional malware. Defenders should investigate unusual sign-ins and directory activity, limit privileges, require multifactor authentication, rotate exposed credentials, and use unique administrative accounts.