Credentials from Password Stores

What is Credentials from Password Stores?

“Credentials from Password Stores is documented as technique T1555 in MITRE ATT&CK® v19.1 under the Credential Access tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Credentials from Password Stores activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for access to Windows Credential Manager vaults, particularly from processes other than credential management applications, using API calls to CredEnumerate, CredRead, and CredentialRead functions from unexpected processes.

2. 2

   Alert on processes reading browser password database files (Login Data for Chrome, logins.json for Firefox) from locations in user profile directories, as legitimate browsers access these files through in-process APIs rather than external file reads.

3. 3

   Detect password manager database file access by unexpected processes, including KeePass KDBX files, LastPass local cache files, and 1Password OPVault directories being opened by processes other than the legitimate password manager application.

4. 4

   Monitor macOS Keychain access by non-Apple processes and newly installed applications, as macOS logs keychain access events that can reveal unauthorized credential extraction from the system keychain or application keychains.

5. 5

   Track execution of known credential extraction tools such as LaZagne, WebBrowserPassView, and CredentialFileView by file name, hash, and behavioral signature including their characteristic file access patterns.

Example Alerts

These realistic alert examples show what Credentials from Password Stores looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Credentials from Password Stores?

Detection centers on XDR, SIEM telemetry for the credential access phase of the attack. Monitor for access to Windows Credential Manager vaults, particularly from processes other than credential management applications, using API calls to CredEnumerate, CredRead, and CredentialRead functions from unexpected processes. Alert on processes reading browser password database files (Login Data for Chrome, logins.json for Firefox) from locations in user profile directories, as legitimate browsers access these files through in-process APIs rather than external file reads.

What does a Credentials from Password Stores alert look like?

A representative XDR detection is "Browser Password Database Accessed by External Process" (high severity): File access event detected: process C:\Users\temp\payload.exe opened Chrome Login Data database file at C:\Users\jsmith\AppData\Local\Google\Chrome\User Data\Default\Login Data. This SQLite database contains all passwords saved in Chrome. The accessing process is not Chrome and has no legitimate reason to read this file. Subsequent network activity shows exfiltration of the extracted credentials to an external server.

Which tools detect Credentials from Password Stores, and how can I practice?

Credentials from Password Stores (T1555) is best surfaced with XDR, SIEM telemetry, which exposes the credential access signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.