Adversaries may search for common password storage locations to obtain user credentials.[1] Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Threat groups85th percentile · 84% of ATT&CK techniques have fewer threat groups attributed.
2
CampaignsTop 17%
Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.
26
Tools & malwareTop 13%
Tools & malware87th percentile · 86% of ATT&CK techniques have fewer tools implementing them.
13
Detection rulesTop 19%
Detection rules81st percentile · 79% of ATT&CK techniques have fewer detection rules written.
Credentials from Password Stores MITRE reference T1555
Top 15%of all ATT&CK techniques for number of groups
12 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.1
2019–2021
All 2 campaigns for this technique
26 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Can harvest credentials from cryptocurrency wallets and keystores such as Ethereum keystores, Cardano keys, Solana validator keypairs, Ledger device files, and Anchor deploy keys.123
Has collected keys stored for Solana stored in .config/solana/id.json and other login details associated with macOS within /Library/Keychains/login.keychain or for Linux within /.local/share/keyrings.1
Credentials from Password Stores detection strategy DET0430
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Credentials Access from Password Stores
Enterprise
4 platforms
AN1198 · Windows
Monitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
TargetProcesses
List of sensitive processes to monitor (e.g., lsass.exe, svchost.exe)
KeywordPatterns
Regex for suspicious command-line arguments such as 'dpapi', 'credman', 'mimikatz'
AN1199 · Linux
Detects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
MonitoredFiles
Paths to password storage files (e.g., /etc/shadow, ~/.local/share/keyrings/)
SuspiciousCommands
Process or command-line keywords that indicate password extraction attempts
AN1200 · macOS
Monitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
AllowedApplications
Whitelist of legitimate processes accessing the Keychain
AlertThreshold
Number of failed access attempts before raising an alert
AN1201 · IaaS
Detects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password.
Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in improper locations.
Limit the number of accounts and services with permission to query information from password stores to only those required. Ensure that accounts and services with permissions to query password stores only have access to the secrets they require.
Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Windows Credentials]
windows
powershell
—
—
—
This module will enumerate credentials stored in Windows Credentials vault of Windows Credential Manager using builtin utility vaultcmd.exe
Attack Commandsrun with powershell
vaultcmd /listcreds:"Windows Credentials" /all
GUID36753ded-e5c4-4eb5-bc3c-e8fba236878d
05
Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Web Credentials]
windows
powershell
—
—
—
This module will enumerate credentials stored in Web Credentials vault of Windows Credential Manager using builtin utility vaultcmd.exe
Attack Commandsrun with powershell
vaultcmd /listcreds:"Web Credentials" /all
GUIDbc071188-459f-44d5-901a-f8f2625b2d2e
06
WinPwn - Loot local Credentials - lazagne
windows
powershell
—
—
—
The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer.
Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.).
This tool has been developed for the purpose of finding these passwords for the most commonly-used software
Warzone/AveMaria RAT Style Credential Theft via Outlook Registry
windows
powershell
—
—
—
Emulates behaviors seen in the Warzone/AveMaria RAT, where credentials associated with a user's Microsoft Outlook profile are stolen through registry access. (https://www.splunk.com/en_us/blog/security/defending-the-gates-understanding-and-detecting-ave-maria-warzone-rat.html)
Top 19%of all ATT&CK techniques for number of rules
Showing 1-13 of 13 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
This detection identifies potentially malicious SQL queries executed through MCP PostgreSQL server connections, monitoring for privilege escalation attempts, credential theft, and schema reconnaissance. (...)
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. (...)
The following analytic detects the execution of the Windows OS tool cmdkey.exe, which is used to create stored usernames, passwords, or credentials. (...)
The following analytic detects the execution of the Windows OS tool cmdkey.exe, which is often abused by post-exploitation tools like winpeas, commonly used in ransomware attacks to list stored usernames, passwords, or credentials. (...)