T1555.004 Windows Credential Manager
Sub-technique of T1555 Credentials from Password Stores
Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker) The Windows Credential…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Suspicious Key Manager Accesshightest · windows
- Access To Windows Credential History File By Uncommon Applicationsmediumtest · windows
- Access To Windows DPAPI Master Keys By Uncommon Applicationsmediumtest · windows
- Windows Credential Manager Access via VaultCmdmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.