Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| CA-7 | Continuous Monitoring | Protects | T1555 | Credentials from Password Stores |
| IA-5 | Authenticator Management | Protects | T1555 | Credentials from Password Stores |
| SI-4 | System Monitoring | Protects | T1555 | Credentials from Password Stores |
| action.malware.variety.Password dumper | Password dumper (extract credential hashes) | related-to | T1555 | Credentials from Password Stores |
| aws_secrets_manager | AWS Secrets Manager | technique_scores | T1555 | Credentials from Password Stores |
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1555.003 | Credentials from Web Browsers | 1 |
| T1555.001 | Keychain | 4 |
| T1555.005 | Password Managers | 7 |
| T1555.002 | Securityd Memory | 5 |
| T1555.004 | Windows Credential Manager | 6 |