Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| AC-20 | Use of External Systems | Protects | T1555 | Credentials from Password Stores |
| AC-06 | Least Privilege | Protects | T1555 | Credentials from Password Stores |
| AC-03 | Access Enforcement | Protects | T1555 | Credentials from Password Stores |
| CA-07 | Continuous Monitoring | Protects | T1555 | Credentials from Password Stores |
| IA-05 | Authenticator Management | Protects | T1555 | Credentials from Password Stores |
| SI-04 | System Monitoring | Protects | T1555 | Credentials from Password Stores |
| DEF-SECA-E3 | Security Alerts | Technique Scores | T1555 | Credentials from Password Stores |
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1555.002 | Securityd Memory | 3 |
| T1555.001 | Keychain | 3 |
| T1555.005 | Password Managers | 6 |
| T1555.006 | Cloud Secrets Management Stores | 4 |
| T1555.004 | Windows Credential Manager | 5 |