Storm-0501G1053 ↗
Has stolen credentials contained in the password manager Keepass by utilizing Find-KeePassConfig.ps1.1
tfMITRE ATT&CK sub-technique
Password Managers T1555.005
sub-technique of T1555 Credentials from Password Stores
- Tactic
- Credential Access
- Platforms
- Linux, macOS, Windows
- Version
- 1.1
- Created
- 22 January 2021
- Last modified
- 24 October 2025
- Contributors
- Matt Burrough, @mattburrough, Microsoft; Don Le, Stifel Financial
Adversaries may acquire user credentials from third-party password managers.[1] Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
7
Threat groupsTop 23%
Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.5
Tools & malware66th pct
Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.4
Detection rules60th pct
Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.Password Managers MITRE reference T1555.005
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
UNC3886G1048 ↗
Has targeted KeyPass password database files for credential access.1
Scattered SpiderG1015 ↗
Has searched for credentials in password vaults and Privileged Access Management (PAM) solutions including HashiCorp Vault.12
LAPSUS$G1004 ↗
Has accessed local password managers and databases to obtain further credentials from a compromised network.1
Indrik SpiderG0119 ↗
Has accessed and exported passwords from password managers.1
Fox KittenG0117 ↗
Has used scripts to access credential information from the KeePass database.1
All 7 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation WocaoC0014 ↗
During Operation Wocao, threat actors accessed and collected credentials from password managers.1
All 1 campaigns for this technique
5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has gathered credentials stored in password managers to include password vaults.123
InvisibleFerretS1245 ↗
Has utilized the command ssh_zcp to exfiltrate data from browser extensions and password managers via Telegram and FTP.12
MarkiRATS0652 ↗
Can gather information from the Keepass password manager.1
TrickBotS0266 ↗
Can steal passwords from the KeePass open source password manager.1
ProtonS0279 ↗
Gathers credentials in files for 1password.1
All 5 software entries for this technique
Offense vs defense T1555.005
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 3
first rule: 2022 Q2 · 1 of 1 campaigns plottedPassword Managers detection strategy DET0597
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Unauthorized Access to Password Managers
3 platforms
AN1641 · Windows
Detection of suspicious access to password manager processes (KeePass, 1Password, LastPass, Bitwarden) through abnormal process injection, memory reads, or command-line usage of vault-related DLLs. Correlates process creation with OS API calls and file access to vault databases (.kdbx, .opvault, .ldb).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File MetadataDC0059 | WinEventLog:Sysmon | EventCode=15 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PasswordManagerBinaries | List of monitored binaries and file formats for password managers in use (e.g., KeePass, 1Password, Bitwarden, LastPass). |
| TimeWindow | Window to correlate process creation, API access, and file reads indicative of credential extraction. |
| UserContext | Filter for administrative accounts vs. expected users of password managers. |
AN1642 · Linux
Suspicious access to password manager vaults (KeePassXC, gnome-keyring, pass) via memory scraping or unauthorized file reads. Detects unusual command execution involving gdb/strace attached to password manager processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process AccessDC0035 | auditd:SYSCALL | ptrace |
| File AccessDC0055 | auditd:SYSCALL | open/read on ~/.local/share/keepassxc/* OR ~/.password-store/* |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| VaultFilePaths | Linux paths to monitor for vault database files (KeePassXC, pass, gnome-keyring). |
| TimeWindow | Correlation interval to detect multiple suspicious access events. |
AN1643 · macOS
Detection of password manager database access (1Password .opvault, LastPass caches, KeePass .kdbx) outside expected parent processes. Identifies memory scraping attempts via suspicious API calls or tools attaching to password manager processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | security OR injection attempts into 1Password OR LastPass |
| Process AccessDC0035 | macos:osquery | unexpected memory inspection |
| File AccessDC0055 | macos:unifiedlog | *.opvault OR *.ldb OR *.kdbx |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| VaultFileExtensions | Password manager file extensions (.opvault, .kdbx, .ldb) to monitor for anomalous access. |
| ParentProcessWhitelist | Expected parent processes that normally access password manager files, for filtering false positives. |
Password PoliciesM1027
Refer to NIST guidelines when creating password policies for master passwords.
Consider re-locking password managers after a short timeout to limit the time plaintext credentials live in memory from decrypted databases.
Update SoftwareM1051
Regularly update web browsers, password managers, and all related software to the latest versions. Keeping software up-to-date reduces the risk of vulnerabilities being exploited by attackers to extract stored credentials or session cookies.
Implement strict user account management policies to prevent unnecessary accounts from accessing sensitive systems. Regularly audit user accounts to identify and disable inactive accounts that may be targeted by attackers to extract credentials or gain unauthorized access.
User TrainingM1017
Provide user training on secure practices for managing credentials, including avoiding storing sensitive passwords in browsers and using password managers securely. Users should also be educated on identifying phishing attempts that could steal session cookies or credentials.