Credential Material on Hosts
Credentials left behind on systems are how privilege escalates between tiers. What accumulates, and how to stop leaving it.
Procedure
Most privilege paths rely on credential material recoverable from a system the attacker already controls. Reducing what is left behind closes them.
What accumulates on a host
Cached credentials from previous interactive logons.
Tokens and tickets from active and recent sessions.
Stored credentials saved for convenience.
Service account passwords in configuration and registry.
Scripts containing credentials, written years ago.
Browser-saved passwords on administrative workstations.
Key material for SSH, certificates and cloud access.
The tiering rule
A credential used on a system is available to whoever controls that system.
From which follows the single most important operational rule in privileged access: tier zero credentials are never used on lower-tier systems.
A domain administrator logging into a workstation to help a user has, for practical purposes, granted domain administrative rights to whoever controls that workstation.
Enforce it technically through logon restrictions rather than by policy, because under incident pressure people will do the convenient thing and be reasonable in doing so.
Reducing what is left
Restrict which accounts may log on interactively to which tiers.
Disable credential caching where operationally feasible, and limit it where not.
Use protocols that do not send reusable credentials to the target — restricted admin modes and similar mechanisms.
Broker sessions so the credential never reaches the administrator's workstation at all.
Clear sessions on disconnect rather than leaving them idle.
Prohibit saved credentials on administrative accounts, enforced by configuration.
Administrative workstations
The dedicated-device control, which is expensive and effective.
A separate, hardened device used only for administrative work.
No email, no browsing, no general software.
Restricted network access to management interfaces only.
Tier zero administration only from tier zero devices.
Expensive in hardware and inconvenience, and the most effective single control for protecting tier zero. Where full deployment is not affordable, applying it to tier zero alone captures most of the value.
Cleaning up what is already there
Scan for credentials in scripts and configuration across the estate.
Scan for stored credentials on administrative accounts.
Rotate anything found, treating discovery as exposure.
Remove the storage, not just the value.
Repeat periodically, because it accumulates again.
Detection
Where prevention is incomplete, notice the use.
Alert on tier zero accounts authenticating to lower-tier systems, which should be rare and deliberate.
Alert on administrative logons from unusual sources.
Alert on credential dumping techniques where endpoint tooling can detect them.
Alert on service accounts logging on interactively, which they should never do and which is a strong signal.
The measure
Count of tier zero logons to non-tier-zero systems, which should be zero and rarely is at the start.
Proportion of administrative sessions brokered rather than performed with a local credential.
Hosts with credentials found in configuration, trending down.
These are checkable from logs you already collect, and they measure the control that closes the most paths.
Restricted admin modes
Protocols that authenticate without leaving reusable credential material on the target.
Available for common remote administration protocols and off by default.
The target receives proof of authentication rather than a reusable credential.
Closes the most common escalation path — a credential harvested from a compromised server.
Requires configuration on both ends and has trade-offs for some workflows.
Enable where the workflow permits, and record where it does not, since those systems remain a path.
Finding what is already stored
Credential material accumulates and periodic cleanup is required rather than optional.
Scan scripts and configuration across the estate for embedded credentials.
Scan stored credentials on administrative accounts.
Scan scheduled tasks for saved passwords.
Check documentation and ticket systems, which is where a surprising amount lives.
Rotate everything found, treating discovery as exposure.
Remove the storage, not just the value, or it returns at the next rotation.
Repeat annually, because it accumulates again.