Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.

Tactics
TA0006 TA0007


See: MITRE ATT&CK