T1555.004 Windows Credential Manager
Subtécnica de T1555 Credentials from Password Stores
Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker) The Windows Credential…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Suspicious Key Manager Accesshightest · windows
- Access To Windows Credential History File By Uncommon Applicationsmediumtest · windows
- Access To Windows DPAPI Master Keys By Uncommon Applicationsmediumtest · windows
- Windows Credential Manager Access via VaultCmdmediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.