Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| cloud_key_management | Cloud Key Management | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control manages symmetric and asymmetric cryptographic keys for cloud services and protects against stealing credentials, certificates, keys from the organization.
References
|
| secret_manager | Secret Manager | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may provide a more secure location for storing passwords. If an cloud user account, endpoint, or application is compromised, they may have limited access to passwords stored in Secret Manager.
References
|