{"id":"T1555","name":"Credentials from Password Stores","url":"https://attack.mitre.org/techniques/T1555","tactics":["credential-access"],"platforms":["IaaS","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0430","stix_id":"x-mitre-detection-strategy--1a273fde-f4fc-4ca0-94d4-7df285167b5e","name":"Detect Credentials Access from Password Stores","url":"https://attack.mitre.org/detectionstrategies/DET0430","analytics":[{"id":"AN1198","stix_id":"x-mitre-analytic--de4fe01d-96d7-4258-a1d6-6958fe50a4ed","name":"Analytic 1198","description":"Monitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.","url":"https://attack.mitre.org/detectionstrategies/DET0430#AN1198","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TargetProcesses","description":"List of sensitive processes to monitor (e.g., lsass.exe, svchost.exe)"},{"field":"KeywordPatterns","description":"Regex for suspicious command-line arguments such as 'dpapi', 'credman', 'mimikatz'"}],"live":true,"detection_strategies":["DET0430"],"techniques":["T1555"]},{"id":"AN1199","stix_id":"x-mitre-analytic--571b10ce-fb7d-492e-b05a-23649ae14148","name":"Analytic 1199","description":"Detects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.","url":"https://attack.mitre.org/detectionstrategies/DET0430#AN1199","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open/read","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:EXECVE","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"}],"mutable_elements":[{"field":"MonitoredFiles","description":"Paths to password storage files (e.g., /etc/shadow, ~/.local/share/keyrings/)"},{"field":"SuspiciousCommands","description":"Process or command-line keywords that indicate password extraction attempts"}],"live":true,"detection_strategies":["DET0430"],"techniques":["T1555"]},{"id":"AN1200","stix_id":"x-mitre-analytic--2bec56a7-957c-44b4-b730-00dd55ff99f8","name":"Analytic 1200","description":"Monitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.","url":"https://attack.mitre.org/detectionstrategies/DET0430#AN1200","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"access to keychain database","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"execution of security or osascript","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"AllowedApplications","description":"Whitelist of legitimate processes accessing the Keychain"},{"field":"AlertThreshold","description":"Number of failed access attempts before raising an alert"}],"live":true,"detection_strategies":["DET0430"],"techniques":["T1555"]},{"id":"AN1201","stix_id":"x-mitre-analytic--2c8326bd-dd59-4715-87ef-dc3bdef919fb","name":"Analytic 1201","description":"Detects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.","url":"https://attack.mitre.org/detectionstrategies/DET0430#AN1201","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"GetSecretValue","data_component":"DC0083","data_component_name":"Cloud Service Enumeration","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"Decrypt","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"UserContext","description":"Correlate cloud API calls with IAM role, user, or service account context"},{"field":"AccessThreshold","description":"Number of secret retrievals within a time window before flagging"}],"live":true,"detection_strategies":["DET0430"],"techniques":["T1555"]}],"live":true,"version":"1.0","techniques":["T1555"]}],"sigma_rules":[{"id":"58f4ea09-0fc2-4520-ba18-b85c540b0eaf","title":"Suspicious Serv-U Process Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-07-14","modified":"2022-07-14","description":"Detects a suspicious process pattern which could be a sign of an exploited Serv-U service","references":["https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1555","cve.2021-35211"],"path":"rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml","techniques":["T1555"],"cves":["CVE-2021-35211"]},{"id":"603c6630-5225-49c1-8047-26c964553e0e","title":"Enumerate Credentials from Windows Credential Manager With PowerShell","author":"frack113","status":"test","level":"medium","date":"2021-12-20","modified":"2022-12-25","description":"Adversaries may search for common password storage locations to obtain user credentials.\nPasswords are stored in several places on a system, depending on the operating system or application holding the credentials.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1555"],"path":"rules/windows/powershell/powershell_script/posh_ps_enumerate_password_windows_credential_manager.yml","techniques":["T1555"],"cves":[]},{"id":"7679d464-4f74-45e2-9e01-ac66c5eb041a","title":"HackTool - SecurityXploded Execution","author":"Florian Roth (Nextron Systems)","status":"stable","level":"critical","date":"2018-12-19","modified":"2023-02-04","description":"Detects the execution of SecurityXploded Tools","references":["https://securityxploded.com/","https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1555"],"path":"rules/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml","techniques":["T1555"],"cves":[]},{"id":"7892ec59-c5bb-496d-8968-e5d210ca3ac4","title":"DPAPI Backup Keys And Certificate Export Activity IOC","author":"Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-06-26","modified":null,"description":"Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.\n","references":["https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/","https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1555","attack.t1552.004"],"path":"rules/windows/file/file_event/file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml","techniques":["T1555","T1552.004"],"cves":[]},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"99c49d9c-34ea-45f7-84a7-4751ae6b2cbc","title":"Dump Credentials from Windows Credential Manager With PowerShell","author":"frack113","status":"test","level":"medium","date":"2021-12-20","modified":"2022-12-25","description":"Adversaries may search for common password storage locations to obtain user credentials.\nPasswords are stored in several places on a system, depending on the operating system or application holding the credentials.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1555"],"path":"rules/windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager.yml","techniques":["T1555"],"cves":[]},{"id":"a840e606-7c8c-4684-9bc1-eb6b6155127f","title":"PUA - AWS TruffleHog Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-10-21","modified":null,"description":"Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.\nIt has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.\n","references":["https://github.com/trufflesecurity/trufflehog","https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.credential-access","attack.t1555","attack.t1003"],"path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_pua_trufflehog.yml","techniques":["T1555","T1003"],"cves":[]},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-5777","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-48928","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-48927","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-24054","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2017-12637","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-55591","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-21893","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-46805","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-27532","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}