THREATNOIR
Subscribe
MITRE ATT&CK · T1555

Credentials from Password Stores

MITRE · cited in 22 of our lessons

Explanation

What attackers do. Attackers search systems for stored passwords in places such as browsers, operating system credential stores, password managers and configuration files, then reuse them. This serves the Credential Access tactic and often fuels lateral movement.

How to defend. Use a managed enterprise password manager rather than browser-saved passwords, apply policy to disable browser password storage where appropriate, and protect credential stores with platform security features. Limit local admin rights, which many extraction tools need. Endpoint detection should watch for unusual access to credential store files and APIs.

Signs to look for. Look for processes other than the owning application reading browser login databases, keychains or credential vault files, and known credential theft tools or infostealer behaviour. A common gap is not considering personal password stores synchronised to corporate devices.

Open the technique on MITRE ATT&CK
The official text
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 22.