Sub-technique of T1555 Credentials from Password Stores.View on attack.mitre.org
Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).
The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of Credentials from Web Browsers, Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker.
Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.
Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager.
Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI.
Password recovery tools may also obtain plain text passwords from the Credential Manager.
Rules on DetectionCode tagged with T1555.004.
| Rule | Level | Log source |
|---|---|---|
| Suspicious Key Manager Access | high | windows / process_creation |
| Access To Windows Credential History File By Uncommon Applications | medium | windows / file_access |
| Access To Windows DPAPI Master Keys By Uncommon Applications | medium | windows / file_access |
| Windows Credential Manager Access via VaultCmd | medium | windows / process_creation |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Windows Credentials Access via VaultCli Module | Anomaly | NULL | Sysmon EventID 7 |
| Used by | Procedure example |
|---|---|
| GroupOilRig | OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager. |
| GroupStealth Falcon | Stealth Falcon malware gathers passwords from the Windows Credential Vault. |
| GroupTurla | Turla has gathered credentials from the Windows Credential Manager tool. |
| GroupWizard Spider | Wizard Spider has used PowerShell cmdlet `Invoke-WCMDump` to enumerate Windows credentials in the Credential Manager in a compromised network. |
| Used by | Procedure example |
|---|---|
| MalwareKGH_SPY | KGH_SPY can collect credentials from the Windows Credential Manager. |
| ToolLaZagne | LaZagne can obtain credentials from Vault files. |
| MalwareLizar | Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function. |
| ToolMimikatz | Mimikatz contains functionality to acquire credentials from the Windows Credential Manager. |
| ToolPowerSploit | PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects. |
| MalwareRainyDay | RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials. |
| MalwareROKRAT | ROKRAT can steal credentials by leveraging the Windows Vault mechanism. |
| ToolSILENTTRINITY | SILENTTRINITY can gather Windows Vault credentials. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
