1. Home
  2. ATT&CK Techniques
  3. T1555 Credentials from Password Stores

T1555 Credentials from Password Stores

Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.AA-05.02 Privileged system access Mitigates T1555 Credentials from Password Stores
Comments
This diagnostic statement protects against Credentials from Password Stores through the use of privileged account management and the use of multi-factor authentication.
References
    DE.CM-06.02 Third-party access monitoring Mitigates T1555 Credentials from Password Stores
    Comments
    This diagnostic statement protects against Credentials from Password Stores through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems.
    References
      PR.PS-02.01 Patch identification and application Mitigates T1555 Credentials from Password Stores
      Comments
      This diagnostic statement is related to the implementation of a patch management program. Applying patches and upgrades for products and systems provided by vendors mitigates the risk of adversaries exploiting known vulnerabilities. For example, performing regular software updates mitigates adversary exploitation of password storage locations to obtain user credentials.
      References
        PR.AA-03.01 Authentication requirements Mitigates T1555 Credentials from Password Stores
        Comments
        This diagnostic statement describes how the organization implement appropriate authentication requirements, including selecting mechanisms based on risk, utilizing multi-factor authentication where necessary, and safeguarding the storage of authenticators like pins and passwords to protect sensitive access credentials.
        References
          PR.IR-01.06 Production environment segregation Mitigates T1555 Credentials from Password Stores
          Comments
          This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise.
          References
            PR.AA-01.01 Identity and credential management Mitigates T1555 Credentials from Password Stores
            Comments
            This diagnostic statement protects against Credentials from Password Stores through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
            References

              NIST 800-53 Mappings

              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
              CA-07 Continuous Monitoring mitigates T1555 Credentials from Password Stores
              IA-05 Authenticator Management mitigates T1555 Credentials from Password Stores
              SI-02 Flaw Remediation mitigates T1555 Credentials from Password Stores
              AC-20 Use of External Systems mitigates T1555 Credentials from Password Stores
              SI-04 System Monitoring mitigates T1555 Credentials from Password Stores
              AC-06 Least Privilege mitigates T1555 Credentials from Password Stores
              AC-03 Access Enforcement mitigates T1555 Credentials from Password Stores
              CM-03 Configuration Change Control mitigates T1555 Credentials from Password Stores

              VERIS Mappings

              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
              action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1555 Credentials from Password Stores
              attribute.confidentiality.data_disclosure None related-to T1555 Credentials from Password Stores

              Azure Mappings

              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
              azure_key_vault Azure Key Vault technique_scores T1555 Credentials from Password Stores
              Comments
              This control may provide a more secure location for storing passwords. If an Azure user account, endpoint, or application is compromised, they may have limited access to passwords stored in the Key Vault.
              References
              1. https://learn.microsoft.com/en-us/azure/key-vault/general/overview
              azure_policy Azure Policy technique_scores T1555 Credentials from Password Stores
              Comments
              This control may provide recommendations for auditing and hardening Azure Key Vault to prevent malicious access and segment key access.
              References
              1. https://learn.microsoft.com/en-us/azure/governance/policy/overview
              2. https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir
              defender_for_app_service Microsoft Defender for Cloud: Defender for App Service technique_scores T1555 Credentials from Password Stores
              Comments
              This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the PowerSploit Exfiltration modules on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score.
              References
              1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference
              2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction
              3. https://azure.microsoft.com/en-us/services/app-service/
              4. https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers
              defender_for_key_vault Microsoft Defender for Key Vault technique_scores T1555 Credentials from Password Stores
              Comments
              This control may detect suspicious secret access from Azure key vaults.
              References
              1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-key-vault-introduction
              2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurekv
              defender_for_resource_manager Microsoft Defender for Resource Manager technique_scores T1555 Credentials from Password Stores
              Comments
              This control may alert on credential dumping from Azure Key Vaults, App Services Configurations, and Automation accounts by specific exploitation toolkits. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. The following alerts may be generated: "MicroBurst exploitation toolkit used to extract secrets from your Azure key vaults", "MicroBurst exploitation toolkit used to extract keys to your storage accounts".
              References
              1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction
              2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-resourcemanager
              defender_for_apis Microsoft Defender for Cloud: Microsoft Defender for APIs technique_scores T1555 Credentials from Password Stores
              Comments
              This control can protect APIs from adversaries attempting to access credentials.
              References
              1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-introduction

              GCP Mappings

              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
              cloud_key_management Cloud Key Management technique_scores T1555 Credentials from Password Stores
              Comments
              This control manages symmetric and asymmetric cryptographic keys for cloud services and protects against stealing credentials, certificates, keys from the organization.
              References
              1. ['https://cloud.google.com/security-key-management']
              secret_manager Secret Manager technique_scores T1555 Credentials from Password Stores
              Comments
              This control may provide a more secure location for storing passwords. If an cloud user account, endpoint, or application is compromised, they may have limited access to passwords stored in Secret Manager.
              References
              1. ['https://cloud.google.com/secret-manager/docs/overview']

              AWS Mappings

              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
              aws_secrets_manager AWS Secrets Manager technique_scores T1555 Credentials from Password Stores
              Comments
              This control may prevent harvesting of credentials from password stores by providing a secure, finely controlled location for secrets storage. This control is only relevant for credentials that would be used from application and configuration files and not those entered directly by an end user.
              References
              1. https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html
              2. https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html

              ATT&CK Subtechniques

              Technique ID Technique Name Number of Mappings
              T1555.002 Securityd Memory 9
              T1555.001 Keychain 6
              T1555.005 Password Managers 20
              T1555.003 Credentials from Web Browsers 8
              T1555.006 Cloud Secrets Management Stores 14
              T1555.004 Windows Credential Manager 8