Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CA-07 | Continuous Monitoring | mitigates | T1555 | Credentials from Password Stores | |
| IA-05 | Authenticator Management | mitigates | T1555 | Credentials from Password Stores | |
| SI-02 | Flaw Remediation | mitigates | T1555 | Credentials from Password Stores | |
| AC-20 | Use of External Systems | mitigates | T1555 | Credentials from Password Stores | |
| SI-04 | System Monitoring | mitigates | T1555 | Credentials from Password Stores | |
| AC-06 | Least Privilege | mitigates | T1555 | Credentials from Password Stores | |
| AC-03 | Access Enforcement | mitigates | T1555 | Credentials from Password Stores | |
| CM-03 | Configuration Change Control | mitigates | T1555 | Credentials from Password Stores |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.Password dumper | Password dumper (extract credential hashes) | related-to | T1555 | Credentials from Password Stores | |
| attribute.confidentiality.data_disclosure | None | related-to | T1555 | Credentials from Password Stores |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| azure_key_vault | Azure Key Vault | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may provide a more secure location for storing passwords. If an Azure user account, endpoint, or application is compromised, they may have limited access to passwords stored in the Key Vault.
References
|
| azure_policy | Azure Policy | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may provide recommendations for auditing and hardening Azure Key Vault to prevent malicious access and segment key access.
References
|
| defender_for_app_service | Microsoft Defender for Cloud: Defender for App Service | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the PowerSploit Exfiltration modules on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score.
References
|
| defender_for_key_vault | Microsoft Defender for Key Vault | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may detect suspicious secret access from Azure key vaults.
References
|
| defender_for_resource_manager | Microsoft Defender for Resource Manager | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may alert on credential dumping from Azure Key Vaults, App Services Configurations, and Automation accounts by specific exploitation toolkits. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. The following alerts may be generated: "MicroBurst exploitation toolkit used to extract secrets from your Azure key vaults", "MicroBurst exploitation toolkit used to extract keys to your storage accounts".
References
|
| defender_for_apis | Microsoft Defender for Cloud: Microsoft Defender for APIs | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control can protect APIs from adversaries attempting to access credentials.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| cloud_key_management | Cloud Key Management | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control manages symmetric and asymmetric cryptographic keys for cloud services and protects against stealing credentials, certificates, keys from the organization.
References
|
| secret_manager | Secret Manager | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may provide a more secure location for storing passwords. If an cloud user account, endpoint, or application is compromised, they may have limited access to passwords stored in Secret Manager.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_secrets_manager | AWS Secrets Manager | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may prevent harvesting of credentials from password stores by providing a secure, finely controlled location for secrets storage. This control is only relevant for credentials that would be used from application and configuration files and not those entered directly by an end user.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1555.002 | Securityd Memory | 9 |
| T1555.001 | Keychain | 5 |
| T1555.005 | Password Managers | 12 |
| T1555.003 | Credentials from Web Browsers | 4 |
| T1555.006 | Cloud Secrets Management Stores | 11 |
| T1555.004 | Windows Credential Manager | 8 |