Credentials from Password Stores (T1555)

Tactic: Credential Access · Platforms: IaaS, Linux, macOS, Windows

The interactive view maps 1 detection strategy, 3 mitigations, 12 threat groups, 25 software entries, 2 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Sub-techniques

• Keychain (T1555.001)
• Securityd Memory (T1555.002)
• Credentials from Web Browsers (T1555.003)
• Windows Credential Manager (T1555.004)
• Password Managers (T1555.005)
• Cloud Secrets Management Stores (T1555.006)

Explore

• Open T1555 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1555
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan