Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
CA-7 | Continuous Monitoring | Protects | T1555 | Credentials from Password Stores | |
IA-5 | Authenticator Management | Protects | T1555 | Credentials from Password Stores | |
SI-4 | System Monitoring | Protects | T1555 | Credentials from Password Stores | |
azure_defender_for_resource_manager | Azure Defender for Resource Manager | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may alert on credential dumping from Azure Key Vaults, App Services Configurations, and Automation accounts by specific exploitation toolkits. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. The following alerts may be generated: "MicroBurst exploitation toolkit used to extract secrets from your Azure key vaults", "MicroBurst exploitation toolkit used to extract keys to your storage accounts".
References
|
azure_sentinel | Azure Sentinel | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures.
References
|
microsoft_defender_for_identity | Microsoft Defender for Identity | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control provides minimal detection for one of this technique's sub-techniques, while not providing any detection for the remaining, resulting in a Minimal score.
References
|
azure_defender_for_key_vault | Azure Defender for Key Vault | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may detect suspicious secret access from Azure key vaults. This does not apply to any sub-techniques under T1555 - Credentials from Password Stores but Azure Key Vault can be treated as a store for passwords, keys, and certificates. The coverage of this control could be deemed high for cloud credential and secret storage within Key Vault but is not applicable to traditional password stores, such as password managers, keychain, or web browsers.
References
|
azure_policy | Azure Policy | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may provide recommendations for auditing and hardening Azure Key Vault to prevent malicious access and segment key access.
References
|
azure_defender_for_app_service | Azure Defender for App Service | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the PowerSploit Exfiltration modules on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score.
References
|
azure_key_vault | Azure Key Vault | technique_scores | T1555 | Credentials from Password Stores |
Comments
This control may provide a more secure location for storing passwords. If an Azure user account, endpoint, or application is compromised, they may have limited access to passwords stored in the Key Vault.
References
|
Technique ID | Technique Name | Number of Mappings |
---|---|---|
T1555.003 | Credentials from Web Browsers | 2 |
T1555.001 | Keychain | 3 |
T1555.002 | Securityd Memory | 3 |