CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. This is a Glexia lookup hint from CWE context, not an official ATT&CK mapping.
Open ATT&CK lookup