Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
PR.AA-05.02 | Privileged system access | Mitigates | T1555 | Credentials from Password Stores |
Comments
This diagnostic statement protects against Credentials from Password Stores through the use of privileged account management and the use of multi-factor authentication.
References
|
DE.CM-06.02 | Third-party access monitoring | Mitigates | T1555 | Credentials from Password Stores |
Comments
This diagnostic statement protects against Credentials from Password Stores through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems.
References
|
PR.PS-02.01 | Patch identification and application | Mitigates | T1555 | Credentials from Password Stores |
Comments
This diagnostic statement is related to the implementation of a patch management program. Applying patches and upgrades for products and systems provided by vendors mitigates the risk of adversaries exploiting known vulnerabilities. For example, performing regular software updates mitigates adversary exploitation of password storage locations to obtain user credentials.
References
|
PR.AA-03.01 | Authentication requirements | Mitigates | T1555 | Credentials from Password Stores |
Comments
This diagnostic statement describes how the organization implement appropriate authentication requirements, including selecting mechanisms based on risk, utilizing multi-factor authentication where necessary, and safeguarding the storage of authenticators like pins and passwords to protect sensitive access credentials.
References
|
PR.IR-01.06 | Production environment segregation | Mitigates | T1555 | Credentials from Password Stores |
Comments
This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise.
References
|
PR.AA-01.01 | Identity and credential management | Mitigates | T1555 | Credentials from Password Stores |
Comments
This diagnostic statement protects against Credentials from Password Stores through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
References
|
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
CA-07 | Continuous Monitoring | mitigates | T1555 | Credentials from Password Stores | |
IA-05 | Authenticator Management | mitigates | T1555 | Credentials from Password Stores | |
SI-02 | Flaw Remediation | mitigates | T1555 | Credentials from Password Stores | |
AC-20 | Use of External Systems | mitigates | T1555 | Credentials from Password Stores | |
SI-04 | System Monitoring | mitigates | T1555 | Credentials from Password Stores | |
AC-06 | Least Privilege | mitigates | T1555 | Credentials from Password Stores | |
AC-03 | Access Enforcement | mitigates | T1555 | Credentials from Password Stores | |
CM-03 | Configuration Change Control | mitigates | T1555 | Credentials from Password Stores |
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
CVE-2025-24054 | Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability | primary_impact | T1555 | Credentials from Password Stores |
Comments
Using a crafted .library-ms file, attackers can exploit this spoofing vulnerability to gain access to NTLM hashes on the system. This was officially patched by Microsoft on March 11, 2025, but has been exploited in the wild as of March 19, 2025.
References
|
CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | secondary_impact | T1555 | Credentials from Password Stores |
Comments
This vulnerability is exploited through a Server-Side Request Forgery (SSRF) weakness in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted request to the /dana-ws/saml.ws endpoint, which can be accessed without authentication. This manipulation allows attackers to interact with internal services, potentially enabling further exploitation by chaining with other vulnerabilities.
References
|
CVE-2025-48928 | TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability | primary_impact | T1555 | Credentials from Password Stores |
Comments
TeleMessage TM SNGL utilizes a JavaServer Pages framework which improperly handles content in heaps and making them functionally the same as a core dump file. Attackers with local access can use this to obtain sensitive information, including credentials.
References
|
CVE-2025-48927 | TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability | primary_impact | T1555 | Credentials from Password Stores |
Comments
TeleMessage TM SNGL's Spring Boot Actuator exposes the /heapdump endpoint publicly, allowing an unauthenticated attacker to access it.
References
|
CVE-2025-5777 | Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability | primary_impact | T1555 | Credentials from Password Stores |
Comments
This memory leak vulnerability in Citrix NetScaler/ADC Gateway devices can be leveraged by sending malicious authentication requests, leaking sensitive information.
References
|
CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | secondary_impact | T1555 | Credentials from Password Stores |
Comments
This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks.
References
|
CVE-2024-55591 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | primary_impact | T1555 | Credentials from Password Stores |
Comments
An attacker can add a local_access_token parameter to a request targeting a specific endpoint on vulnerable Fortinet devices, leading to an authentication bypass. From there, they can obtain super_admin privileges.
References
|
CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | secondary_impact | T1555 | Credentials from Password Stores |
Comments
CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools.
References
|
CVE-2017-12637 | SAP NetWeaver Directory Traversal Vulnerability | secondary_impact | T1555 | Credentials from Password Stores |
Comments
By exploiting this vulnerability in SAP Netweaver Java, the attacker can inject directory traversal commands, allowing for navigation of the file system beyond intended access. This can additionally lead to the discovery of password stores, as well as information about the host system, providing information that can be used in further attacks.
References
|
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
action.malware.variety.Password dumper | Password dumper (extract credential hashes) | related-to | T1555 | Credentials from Password Stores | |
attribute.confidentiality.data_disclosure | None | related-to | T1555 | Credentials from Password Stores |
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
microsoft_sentinel | Microsoft Sentinel | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures.
References
|
azure_key_vault | Azure Key Vault | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may provide a more secure location for storing passwords. If an Azure user account, endpoint, or application is compromised, they may have limited access to passwords stored in the Key Vault.
References
|
azure_policy | Azure Policy | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may provide recommendations for auditing and hardening Azure Key Vault to prevent malicious access and segment key access.
References
|
defender_for_app_service | Microsoft Defender for Cloud: Defender for App Service | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the PowerSploit Exfiltration modules on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score.
References
|
defender_for_key_vault | Microsoft Defender for Key Vault | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may detect suspicious secret access from Azure key vaults.
References
|
defender_for_resource_manager | Microsoft Defender for Resource Manager | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may alert on credential dumping from Azure Key Vaults, App Services Configurations, and Automation accounts by specific exploitation toolkits. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. The following alerts may be generated: "MicroBurst exploitation toolkit used to extract secrets from your Azure key vaults", "MicroBurst exploitation toolkit used to extract keys to your storage accounts".
References
|
defender_for_apis | Microsoft Defender for Cloud: Microsoft Defender for APIs | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control can protect APIs from adversaries attempting to access credentials.
References
|
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
cloud_key_management | Cloud Key Management | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control manages symmetric and asymmetric cryptographic keys for cloud services and protects against stealing credentials, certificates, keys from the organization.
References
|
secret_manager | Secret Manager | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may provide a more secure location for storing passwords. If an cloud user account, endpoint, or application is compromised, they may have limited access to passwords stored in Secret Manager.
References
|
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
aws_secrets_manager | AWS Secrets Manager | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may prevent harvesting of credentials from password stores by providing a secure, finely controlled location for secrets storage. This control is only relevant for credentials that would be used from application and configuration files and not those entered directly by an end user.
References
|
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
DEF-ID-E5 | Microsoft Defender for Identity | Technique Scores | T1555 | Credentials from Password Stores |
Comments
This control provides minimal detection for some of this technique's sub-techniques, while not providing any detection for the remaining, resulting in a Minimal score.
References
|
DEF-SECA-E3 | Security Alerts | Technique Scores | T1555 | Credentials from Password Stores |
Comments
Microsoft Defender security alerts explain the suspicious activities detected by Defender for Identity sensors on your network, and the actors and computers involved in each threat. Alert evidence lists contain direct links to the involved users and computers, to help make your investigations easy and direct.
Defender security alerts are divided into the following categories or phases, like the phases seen in a typical cyber-attack kill chain. Learn more about each phase, the alerts designed to detect each attack, and how to use the alerts to help protect your network using the following links:
Reconnaissance and discovery alerts
Persistence and privilege escalation alerts
Credential access alerts
Lateral movement alerts
Other alerts
License: A Microsoft 365 security product license entitles customer use
of Microsoft Defender XDR.
References
|
Technique ID | Technique Name | Number of Mappings |
---|---|---|
T1555.002 | Securityd Memory | 9 |
T1555.001 | Keychain | 6 |
T1555.005 | Password Managers | 19 |
T1555.003 | Credentials from Web Browsers | 10 |
T1555.006 | Cloud Secrets Management Stores | 14 |
T1555.004 | Windows Credential Manager | 9 |