MITRE ATT&CK technique · Credential Access

`T1555.005` Password Managers

Sub-technique of T1555 Credentials from Password Stores

Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Mini Shai-Hulud

Sigma rules to hunt it

Remote Thread Created In KeePass.EXEhightest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.