T1555 · Credentials from Password Stores

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1555 · Credentials from Password Stores · Sunturai

attack-patternenterprise-attackT1555

Credentials from Password Stores

attack-pattern--3fc9b85a-2862-4363-a64d-d692e3ffbee0

Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Created: Feb 11, 2020, 6:48 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

6 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

86 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Delinea - Secret access fan-out by user	Unknown	Microsoft Sentinel analytics	Oct 7, 2026	MIT License
Delinea - Secret access audit trail	Unknown	Microsoft Sentinel analytics	Oct 7, 2026	MIT License
Delinea - Off-hours privileged activity	Unknown	Microsoft Sentinel analytics	Oct 7, 2026	MIT License
Delinea - Sensitive secret accessed by new user (first access in 14 days)	High	Microsoft Sentinel analytics	Oct 7, 2026	MIT License
Delinea - Privileged account access anomaly (secret-access volume vs baseline)	Medium	Microsoft Sentinel analytics	Oct 7, 2026	MIT License
Delinea - Bulk secret export / access	Medium	Microsoft Sentinel analytics	Oct 7, 2026	MIT License
First Time Python Accessed Sensitive Credential Files	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
GenAI Process Accessing Sensitive Files	High	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Wireless Credential Dumping using Netsh Command	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Veeam Credential Access Command	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Veeam Backup Library Loaded by Unusual Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Searching for Saved Credentials via VaultCmd	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Multiple Vault Web Credentials Read	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Protected Storage Service Access via SMB	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PowerShell Script with Veeam Credential Access Capabilities	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Invoke-Mimikatz PowerShell Script	Critical	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Creation or Modification of Domain Backup DPAPI private key	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Credential Access via Trusted Developer Utility	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Browser Process Spawned from an Unusual Parent	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
SystemKey Access via Command Line	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Web Browser Sensitive File Access	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Keychain Password Retrieval via Command Line	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Dumping of Keychain Content via Security Command	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Keychain CommandLine Interaction via Unsigned or Untrusted Process	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
CyberArk Privileged Access Security Recommended Monitor	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 86

Filter in the catalogue

External references

mitre-attackT1555Open reference

F-Secure The DukesOpen reference

Platforms

IaaSLinuxmacOSWindows

Kill chain phases

credential-access

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object