Credentials from Password Stores

What is Credentials from Password Stores?

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on an operating system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users to manage and maintain credentials. These password managers are often targets for attackers because they consolidate access to many credentials in a single location protected by a single master password or authentication factor. Common credential storage locations include the Windows Credential Manager, macOS Keychain, Linux secret service APIs, web browser saved passwords databases (Chrome, Firefox, Edge), and third-party password manager databases. Credential theft from password stores can provide attackers with credentials for a wide variety of services, accounts, and systems simultaneously, dramatically accelerating the pace of a breach by eliminating the need to attack individual accounts separately.

“Credentials from Password Stores is documented as technique T1555 in the MITRE ATT&CK knowledge base under the Credential Access tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Credentials from Password Stores activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for access to Windows Credential Manager vaults, particularly from processes other than credential management applications, using API calls to CredEnumerate, CredRead, and CredentialRead functions from unexpected processes.

2. 2

   Alert on processes reading browser password database files (Login Data for Chrome, logins.json for Firefox) from locations in user profile directories, as legitimate browsers access these files through in-process APIs rather than external file reads.

3. 3

   Detect password manager database file access by unexpected processes, including KeePass KDBX files, LastPass local cache files, and 1Password OPVault directories being opened by processes other than the legitimate password manager application.

4. 4

   Monitor macOS Keychain access by non-Apple processes and newly installed applications, as macOS logs keychain access events that can reveal unauthorized credential extraction from the system keychain or application keychains.

5. 5

   Track execution of known credential extraction tools such as LaZagne, WebBrowserPassView, and CredentialFileView by file name, hash, and behavioral signature including their characteristic file access patterns.

Example Alerts

These realistic alert examples show what Credentials from Password Stores looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Credentials from Password Stores?

SOC analysts detect Credentials from Password Stores (T1555) by monitoring XDR, SIEM telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor for access to windows credential manager vaults, particularly from processes other than credential management applications, using api calls to. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Credentials from Password Stores?

Credentials from Password Stores can be detected using XDR, SIEM platforms. XDR tools are particularly effective for this technique because they provide visibility into the credential access phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Credentials from Password Stores in real-world attacks?

Credentials from Password Stores is a well-documented MITRE ATT&CK technique in the Credential Access tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Credentials from Password Stores scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Credentials from Password Stores for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Credential Access techniques like Credentials from Password Stores. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.