Credential access

Credentials are the most valuable thing in most environments, because using them does not look like an attack.

An attacker with valid credentials is a user. No exploit, no malware, nothing for a detection to match. That is why so much attacker effort goes into harvesting them from memory, from files, from browsers and from people, and why credential theft is worth defending against more heavily than the intrusion that preceded it.