Cross-source coverage

T1555.005 / ATT&CK

Credentials from Password Stores: Password Managers

4 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.

Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory. Adversaries may extract credentials from memory via Exploitation for Credential Access. Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.

Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogmacos:osquery

How MITRE says to detect it DET0597

Detect Unauthorized Access to Password Managers

Windows Analytic 1641

Detection of suspicious access to password manager processes (KeePass, 1Password, LastPass, Bitwarden) through abnormal process injection, memory reads, or command-line usage of vault-related DLLs. Correlates process creation with OS API calls and file access to vault databases (.kdbx,.opvault,.ldb).

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Sysmon EventCode=15

Linux Analytic 1642

Suspicious access to password manager vaults (KeePassXC, gnome-keyring, pass) via memory scraping or unauthorized file reads. Detects unusual command execution involving gdb/strace attached to password manager processes.

  • auditd:SYSCALL open/read on ~/.local/share/keepassxc/* OR ~/.password-store/*
  • auditd:SYSCALL ptrace

macOS Analytic 1643

Detection of password manager database access (1Password.opvault, LastPass caches, KeePass.kdbx) outside expected parent processes. Identifies memory scraping attempts via suspicious API calls or tools attaching to password manager processes.

  • macos:unifiedlog security OR injection attempts into 1Password OR LastPass
  • macos:unifiedlog *.opvault OR *.ldb OR *.kdbx
  • macos:osquery unexpected memory inspection

View on attack.mitre.org ↗

splunk/security_content

3 rules
Detection Severity Format
Linux Auditd Find Credentials From Password Managers Undefined SPL
Linux Auditd Find Credentials From Password Stores Undefined SPL
Windows Password Managers Discovery Undefined SPL

SigmaHQ/sigma

1 rule
Detection Severity Format
Remote Thread Created In KeePass.EXE High Sigma

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.