* [Blog](https://www.paloaltonetworks.com/blog) * [Palo Alto Networks](https://www.paloaltonetworks.com/blog/corporate/) * Credential Theft # Palo Alto Networks ## Credential Theft [![How Behavioral Analytics Stop Linux C2 \& Credential Theft](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/03/M-Working-at-Computer.jpg)](https://www.paloaltonetworks.com/blog/security-operations/how-behavioral-analytics-stop-linux-c2-credential-theft/) [How Behavioral Analytics Stop Linux C2 \& Credential Theft \----------------------------------------------------------](https://www.paloaltonetworks.com/blog/security-operations/how-behavioral-analytics-stop-linux-c2-credential-theft/) Learn how behavioral analytics detect Linux C2 communication and credential theft --- including LOLBin abuse, beaconing malware, and post-exploitation credential access. See how Cortex XDR and Cortex CDR closes the Linux blind spot. [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown) Mar 17, 2026 By [Shaked Menachem](https://www.paloaltonetworks.com/blog/author/shaked-menachem/?ts=markdown "Posts by Shaked Menachem"), [Maor Korkos](https://www.paloaltonetworks.com/blog/author/maor-korkos/?ts=markdown "Posts by Maor Korkos") and [Alice Nguyen](https://www.paloaltonetworks.com/blog/author/alice-nguyen/?ts=markdown "Posts by Alice Nguyen") ## Palo Alto Networks *** ** * ** *** [Announcements](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown) *** ** * ** *** [Company and Culture](https://www.paloaltonetworks.com/blog/category/company-culture/?ts=markdown) *** ** * ** *** [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown) *** ** * ** *** [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown) *** ** * ** *** [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) *** ** * ** *** [Partners](https://www.paloaltonetworks.com/blog/category/partners/?ts=markdown) *** ** * ** *** ![Detecting Credential Stealing with Cortex XDR](https://www.paloaltonetworks.com/blog/wp-content/uploads/2022/03/Serious-Man-2-1.jpg) [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) ## [Detecting Credential Stealing with Cortex XDR](https://www.paloaltonetworks.com/blog/security-operations/detecting-credential-stealing-with-cortex-xdr/) In this blog post, we review some common credential stealing techniques, mainly focusing on Mimikatz implementation, demonstrate attack scenarios using Mimikatz and explain how Cortex XDR protects our customers... Apr 04, 2022 By [Hila Cohen](https://www.paloaltonetworks.com/blog/author/hila-cohen/?ts=markdown "Posts by Hila Cohen") ![Palo Alto Networks News of the Week: December 2, 2017](https://www.paloaltonetworks.com/blog/wp-content/uploads/2017/09/Linkedin-520x320-v1-2.png) [Uncategorized](https://www.paloaltonetworks.com/blog/category/uncategorized/?ts=markdown) ## [Palo Alto Networks News of the Week: December 2, 2017](https://www.paloaltonetworks.com/blog/2017/12/palo-alto-networks-news-week-december-2-2017/) Sit back, relax and enjoy the top Palo Alto Networks news of the week. Dec 02, 2017 By [Justin Hall](https://www.paloaltonetworks.com/blog/author/justin-hall/?ts=markdown "Posts by Justin Hall") ![Protect Legacy Apps and IoT From Credential Abuse With RSA and Palo Alto Networks](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/11/blog-generic-banner-1.jpg) [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown) ## [Protect Legacy Apps and IoT From Credential Abuse With RSA and Palo Alto Ne...](https://www.paloaltonetworks.com/blog/2017/11/protect-legacy-apps-iot-credential-abuse-rsa-palo-alto-networks/) Protect legacy applications and IoT from credential abuse with RSA and Palo Alto Networks. Nov 29, 2017 By [Kasey Cross](https://www.paloaltonetworks.com/blog/author/kasey-cross/?ts=markdown "Posts by Kasey Cross") ![Palo Alto Networks News of the Week – June 24, 2017](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/11/blog-generic-banner-1.jpg) [Uncategorized](https://www.paloaltonetworks.com/blog/category/uncategorized/?ts=markdown) ## [Palo Alto Networks News of the Week -- June 24, 2017](https://www.paloaltonetworks.com/blog/2017/06/palo-alto-networks-news-week-june-17-2017-2/) Did you miss any of this week's Palo Alto Networks action? Don't worry -- we've rounded up our top news and views right here: Jun 24, 2017 By [Justin Hall](https://www.paloaltonetworks.com/blog/author/justin-hall/?ts=markdown "Posts by Justin Hall") ![PAN-OS 8.0: Announcing New and Expanded Partner Integrations](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/11/blog-generic-banner-1.jpg) [Partners](https://www.paloaltonetworks.com/blog/category/partners/?ts=markdown) ## [PAN-OS 8.0: Announcing New and Expanded Partner Integrations](https://www.paloaltonetworks.com/blog/2017/03/pan-os-8-0-announcing-new-expanded-partner-integrations/) PAN-OS 8.0: Announcing New and expanded partner integrations. Mar 13, 2017 By [Eila Shargh](https://www.paloaltonetworks.com/blog/author/eila-shargh/?ts=markdown "Posts by Eila Shargh") ![Palo Alto Networks News of the Week – February 18, 2017](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/11/blog-generic-banner-1.jpg) [Uncategorized](https://www.paloaltonetworks.com/blog/category/uncategorized/?ts=markdown) ## [Palo Alto Networks News of the Week -- February 18, 2017](https://www.paloaltonetworks.com/blog/2017/02/palo-alto-networks-news-week-february-18-2017/) Sit back, relax and enjoy the top Palo Alto Networks news of the week! Feb 18, 2017 By [Justin Hall](https://www.paloaltonetworks.com/blog/author/justin-hall/?ts=markdown "Posts by Justin Hall") ![What Is a Credential-Based Attack?](https://www.paloaltonetworks.com/blog/wp-content/uploads/2017/02/social-graphic-temp-Dec-PT-SC-Linkedin-698x400.jpg) [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) ## [What Is a Credential-Based Attack?](https://www.paloaltonetworks.com/blog/2017/02/credential-based-attack/) Phishing and credential-based attacks have proven to be one of the most effective means of penetrating an organization. Attackers utilize various password-theft techniques to breach organizations, compromise their networks and steal critical data. There are two elements... Feb 16, 2017 By [Karin Shopen](https://www.paloaltonetworks.com/blog/author/karin-shopen/?ts=markdown "Posts by Karin Shopen") ![PAN-OS 8.0: Preventing Credential-Based Attacks](https://www.paloaltonetworks.com/blog/wp-content/uploads/2016/11/blog-generic-banner-1.jpg) [Uncategorized](https://www.paloaltonetworks.com/blog/category/uncategorized/?ts=markdown) ## [PAN-OS 8.0: Preventing Credential-Based Attacks](https://www.paloaltonetworks.com/blog/2017/02/pan-os-8-0-preventing-credential-based-attacks/) Learn how to prevent credential-based attacks with PAN-OS 8.0 Feb 07, 2017 By [Brian Tokuyoshi](https://www.paloaltonetworks.com/blog/author/brian-tokuyoshi/?ts=markdown "Posts by Brian Tokuyoshi") ![Announcing PAN-OS 8.0 – Our Biggest Launch Yet!](https://www.paloaltonetworks.com/blog/wp-content/uploads/2017/02/rome-twitter2-440x220.jpg) [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown) ## [Announcing PAN-OS 8.0 -- Our Biggest Launch Yet!](https://www.paloaltonetworks.com/blog/2017/02/announcing-pan-os-8-0-biggest-launch-yet/) Learn about PAN-OS 8.0, the largest product and feature release in the history of Palo Alto Networks. Feb 07, 2017 By [Frank Mong](https://www.paloaltonetworks.com/blog/author/frank-mong/?ts=markdown "Posts by Frank Mong") Load more blogs ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language