Cross-source coverage
T1555 / ATT&CK
Credentials from Password Stores
From MITRE ATT&CK 19.2
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
- Tactics
- Credential Access
- Platforms
- IaaS · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLauditd:EXECVEmacos:unifiedlogAWS:CloudTrail
How MITRE says to detect it DET0430
Detect Credentials Access from Password Stores
Windows Analytic 1198
Monitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.
WinEventLog:SysmonEventCode=10WinEventLog:SecurityEventCode=4663, 4670, 4656WinEventLog:SysmonEventCode=1
Linux Analytic 1199
Detects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.
auditd:SYSCALLopen/readauditd:EXECVEexecve
macOS Analytic 1200
Monitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.
macos:unifiedlogaccess to keychain databasemacos:unifiedlogexecution of security or osascript
IaaS Analytic 1201
Detects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.
AWS:CloudTrailGetSecretValueAWS:CloudTrailDecrypt
Sub-techniques with coverage
Counted in the 142 above — a rule tagged a sub-technique covers this technique too.
elastic/protections-artifacts
38 rules · 36 families| Detection | Severity | Format |
|---|---|---|
| Access to Browser Credentials from Suspicious Memory | Undefined | Elastic TOML |
| Access to Windows Passwords Vault by Unusual Process | Undefined | Elastic TOML |
| Access to Windows Passwords Vault via Powershell | Undefined | Elastic TOML |
| Chrome Browser Spawned from an Unusual Parent | Undefined | Elastic TOML |
| Failed Access Attempt to Web Browser Files | Undefined | Elastic TOML |
| Failed Attempts to Access Sensitive Files | Undefined | Elastic TOML |
| Keychain Credential Files Collected via Archive Utility | Undefined | Elastic TOML |
| Keychain Dump via Native Security Tool | Undefined | Elastic TOML |
| Potential Browser Credentials Stealer | Undefined | Elastic TOML |
| Potential Credential Access via Windows Credential History | Undefined | Elastic TOML |
+ 28 more from elastic/protections-artifacts → showing the 10 highest-severity
elastic/detection-rules
29 rules| Detection | Severity | Format |
|---|---|---|
| Potential Invoke-Mimikatz PowerShell Script | Critical | Elastic TOML |
| AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity | High | Elastic TOML |
| Azure Key Vault Unusual Secret Key Usage | High | Elastic TOML |
| Browser Process Spawned from an Unusual Parent | High | Elastic TOML |
| Creation or Modification of Domain Backup DPAPI private key | High | Elastic TOML |
| CyberArk Privileged Access Security Recommended Monitor | High | Elastic TOML |
| Dumping of Keychain Content via Security Command | High | Elastic TOML |
| GenAI Process Accessing Sensitive Files | High | Elastic TOML |
| Keychain CommandLine Interaction via Unsigned or Untrusted Process | High | Elastic TOML |
| Keychain Password Retrieval via Command Line | High | Elastic TOML |
+ 19 more from elastic/detection-rules → showing the 10 highest-severity
SigmaHQ/sigma
20 rules| Detection | Severity | Format |
|---|---|---|
| HackTool - SecurityXploded Execution | Critical | Sigma |
| DPAPI Backup Keys And Certificate Export Activity IOC | High | Sigma |
| HackTool - WinPwn Execution | High | Sigma |
| HackTool - WinPwn Execution - ScriptBlock | High | Sigma |
| Remote Thread Created In KeePass.EXE | High | Sigma |
| SQLite Chromium Profile Data DB Access | High | Sigma |
| Suspicious Key Manager Access | High | Sigma |
| Suspicious Serv-U Process Pattern | High | Sigma |
| Access to Browser Login Data | Medium | Sigma |
| Access To Windows Credential History File By Uncommon Applications | Medium | Sigma |
+ 10 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
16 rules| Detection | Severity | Format |
|---|---|---|
| Potential credential dumping with LaZagne targeting browser password stores | High | Wazuh XML |
| Powershell script: Browser/input data theft cmdlet detected | High | Wazuh XML |
| Sysmon - Event 1: Process creation · BrowserCollector Executed (T1555.003) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Esentutl Chrome Login Dump (T1555.003) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · LaZagne Credential Theft (T1555) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerSharpPack Sharpweb (T1555.003) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Credential Dump Script (T1555) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Invoke-WCMDump (T1555.004) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · VaultCmd Credential Access (T1555.004) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · vaultcmd Web Credentials (T1555) | High | Wazuh XML |
+ 6 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
splunk/security_content
14 rules| Detection | Severity | Format |
|---|---|---|
| Linux Auditd Find Credentials From Password Managers | Undefined | SPL |
| Linux Auditd Find Credentials From Password Stores | Undefined | SPL |
| MacOS Keychains Dumped | Undefined | SPL |
| MCP Postgres Suspicious Query | Undefined | SPL |
| Non Chrome Process Accessing Chrome Default Dir | Undefined | SPL |
| Non Firefox Process Access Firefox Profile Dir | Undefined | SPL |
| Possible Browser Pass View Parameter | Undefined | SPL |
| Windows Credentials Access via VaultCli Module | Undefined | SPL |
| Windows Credentials from Password Stores Chrome Copied in TEMP Dir | Undefined | SPL |
| Windows Credentials from Password Stores Creation | Undefined | SPL |
+ 4 more from splunk/security_content → showing the 10 highest-severity
panther-labs/panther-analysis
9 rules| Detection | Severity | Format |
|---|---|---|
| Okta SWA Bulk Access, New Source, and Credential Extraction - Behavioral | High | Panther Python |
| Okta SWA Off-Hours Credential Access - Behavioral | High | Panther Python |
| AWS Decrypt SSM Parameters | Medium | Panther Python |
| Azure Key Vault Key Accessed or Recovered | Medium | Panther Python |
| Azure Key Vault Secret Accessed or Recovered | Medium | Panther Python |
| Databricks Repeated Access to Secrets | Medium | Panther Python |
| Unusual 1Password Client Detected | Medium | Panther Python |
| AWS EC2 Many Password Read Attempts | Informational | Panther Python |
| Azure Key Vault Certificate Accessed | Informational | Panther Python |
falcosecurity/rules
5 rules| Detection | Severity | Format |
|---|---|---|
| Create Hardlink Over Sensitive Files | Medium | Falco YAML |
| Create Symlink Over Sensitive Files | Medium | Falco YAML |
| Directory traversal monitored file read | Medium | Falco YAML |
| Read sensitive file trusted after startup | Medium | Falco YAML |
| Read sensitive file untrusted | Medium | Falco YAML |
chronicle/detection-rules
4 rules| Detection | Severity | Format |
|---|---|---|
| aws_ec2_get_windows_admin_password | High | YARA-L |
| gcp_service_api_key_retrieved | High | YARA-L |
| aws_api_gateway_get_keys | Low | YARA-L |
| recon_credential_theft_cisa_report | Low | YARA-L |
Wazuh Core Ruleset
3 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious process loaded VaultCli.dll module. Possible use to dump stored passwords. | High | Wazuh XML |
| Anomaly URL query (attempting to pass null termination). | Medium | Wazuh XML |
| The value for the parameter to the browser service was illegal | Medium | Wazuh XML |
Azure/Azure-Sentinel
2 rules| Detection | Severity | Format |
|---|---|---|
| Trust Monitor Event | Medium | KQL |
| BitLocker Key Retrieval | Undefined | KQL |
chainguard-dev/osquery-defense-kit
2 rules · 1 family| Detection | Severity | Format |
|---|---|---|
| Unexpected programs accessing sensitive data stores (state-based) 2 variants | Undefined | osquery SQL |
| Unexpected programs accessing sensitive data stores (state-based) 2 variants | Undefined | osquery SQL |