Credential Harvest: Credentials Left on Computers Someone Else Controls (T1003)

Overview

When a privileged account logs on to a computer interactively or over Remote Desktop, it can leave a reusable credential in LSASS memory. Whoever controls that computer can take the credential. A credential harvest is that pair: an identity that controls a computer, and a privileged account whose credential is on it.

An identity controls a computer when it has any of these:

• local administrator rights, or an admin-equivalent runtime privilege
• ACL control over the computer object, such as GenericAll or WriteDacl
• Group Policy control over the computer
• ownership of the computer object
• resource-based constrained delegation (RBCD) to it

Only privileged accounts count. An account is privileged when it's Tier 0, has criticality High or Critical, or is protected by AdminSDHolder.

Network logons and Restricted Admin Remote Desktop sessions leave no reusable credential, so they never count. A logon counts for 30 days by default.

Directory-only tools show the control and the session as two separate lists. Credential Harvest joins them into one path: controller, computer, privileged account. The path then continues into everything the harvested account can reach. That's why harvest paths also appear in Graph Explorer, Critical Junctions and Boundary Escape.

---

Prerequisites

• Role: Operator or Admin. The Credential Harvest link sits under Exposure in the sidebar and doesn't appear for Viewers.
• Session data: A logon counts only when GraphnAI saw it leave a credential. That needs logon events (4624, with its logon type) from your domain controllers or computers. See Telemetry Pipeline.
• Control data: Local administrator, ACL and Group Policy control come from your sync. See Local Administrators.
• A finished analysis run: The analysis runs after a sync. Until the first run finishes, the page says it hasn't run.

---

Step-by-step

Find the accounts exposed to a harvest

1. Select Credential Harvest under Exposure in the sidebar.
2. Read the three cards: Harvest paths, Victims exposed and Hosts involved.
3. Read the table. It sorts by Severity, highest first. Select a column header to sort by it.

A card shows a dash when the analysis hasn't run or is turned off. A dash isn't zero.

See which computers carry a path

1. Select the Via hosts cell of a row.
2. Read the list under the row. Each line gives the computer, the kind of control and the logon types that left the credential, such as Interactive or RemoteInteractive.

A warning icon beside a computer means results for it are incomplete. See Incomplete results for a computer.

Investigate a path

1. Select a row. A flyout opens with the victim as its title.
2. Read Harvest chain. It draws attacker, computer and victim, one chain per computer, with the fidelity of that computer.
3. Read Session evidence. It gives the logon types seen on the computer with their counts, how many sessions were elevated or restricted, and the last credential logon. Network logons are left out of the list and only counted, because a network logon leaves no reusable credential.
4. Read Control evidence. It gives the kind of control, its fidelity and the permissions behind it. An information icon explains a fidelity below Validated.
5. Select Open victim in graph or Open attacker in graph to continue in Graph Explorer.

If other identities can also take the victim's credentials, the flyout counts them at the bottom.

Fidelity

Fidelity says how well the path is evidenced. A path is only as strong as its weaker half.

• Validated: runtime telemetry saw the control, for example a privilege held at logon. The session was also seen in telemetry.
• Constrained or Theoretical: the control comes from directory configuration, such as an ACL or a local administrator group, and not from telemetry.

The information icon in Control evidence says "The control was seen in the directory, not in runtime telemetry" for the second case.

Remediate a harvest path

You can't remove the harvest itself. GraphnAI derives it from a control and a logon, so it offers no action on the path. Instead, Select Fire says: "This path comes from control of a computer where a privileged account logged on. Remove that control, or keep the account from logging on to that computer."

To close a path, do one of these:

1. Remove the control. Take the account out of the local Administrators group, remove the ACL entry, or remove the Group Policy control. Use Select Fire where it offers the change.
2. Stop the privileged account logging on there. Apply a tiered admin model, so Tier 0 accounts log on only to Tier 0 computers. Use Restricted Admin or Remote Credential Guard for Remote Desktop, and add the account to Protected Users.

After the next sync, the path leaves the list once the control is gone, or once the last credential logon is older than the freshness window.

Where else a harvest shows

• Graph Explorer: Credential harvest edges run from the controlling identity to the victim. Turn them on or off in the View menu. See Graph Explorer.
• Critical Junctions: An attack path that uses a harvest reads "Credential harvest via HOST" under the path. See Critical Junctions.
• Boundary Escape: A harvest that crosses a forest boundary is listed as an escape. It carries the Credential harvest carrier and sorts above trust escalations, because credential theft is a class that SID filtering can't block. See Boundary Escape.

---

What the page says when the set is missing or partial

Incomplete results for a computer

A computer with very many paths through it keeps only the most privileged ones. A banner says "Results are incomplete for 1 host. It shows the most privileged paths it kept." For several, it says "Results are incomplete for N hosts." The warning icon on a computer reads "Showing X of Y paths through this host". The paths that were cut are the least privileged. An administrator can raise the paths-per-computer setting to see more.

---

Configuration

The analysis runs after each sync, as part of reach analytics. Turning reach analytics off stops it too. An administrator can change four settings in the server configuration:

---

Limits

• Pairs, not logons. One row is one attacker and victim pair. Every computer that joins them sits under Via hosts.
• Groups stay whole. A group that controls a computer is one row. It isn't expanded to its members.
• Privileged victims only. An ordinary account with a credential on the computer isn't listed.
• Credential logons only. The date comes from the last logon that left a credential, not from the last activity.
• No action on the path. Remediate the control or the logon.

---

Troubleshooting