| ID | Name |
|---|---|
| T1555.001 | Keychain |
| T1555.002 | Securityd Memory |
| T1555.003 | Credentials from Web Browsers |
| T1555.004 | Windows Credential Manager |
| T1555.005 | Password Managers |
| T1555.006 | Cloud Secrets Management Stores |
Adversaries may acquire user credentials from third-party password managers.[1] Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.[1]
Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.[2][3] Adversaries may extract credentials from memory via Exploitation for Credential Access.[4] Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.[5]
| ID | Name | Description |
|---|---|---|
| G0117 | Fox Kitten |
Fox Kitten has used scripts to access credential information from the KeePass database.[6] |
| G0119 | Indrik Spider |
Indrik Spider has accessed and exported passwords from password managers.[7] |
| G1004 | LAPSUS$ |
LAPSUS$ has accessed local password managers and databases to obtain further credentials from a compromised network.[8] |
| S0652 | MarkiRAT |
MarkiRAT can gather information from the Keepass password manager.[9] |
| C0014 | Operation Wocao |
During Operation Wocao, threat actors accessed and collected credentials from password managers.[2] |
| S0279 | Proton | |
| G0027 | Threat Group-3390 |
Threat Group-3390 obtained a KeePass database from a compromised host.[11] |
| S0266 | TrickBot |
TrickBot can steal passwords from the KeePass open source password manager.[5] |
| ID | Mitigation | Description |
|---|---|---|
| M1027 | Password Policies |
Refer to NIST guidelines when creating password policies for master passwords.[12] |
| M1054 | Software Configuration |
Consider re-locking password managers after a short timeout to limit the time plaintext credentials live in memory from decrypted databases. |
| M1051 | Update Software |
Regularly update web browsers, password managers, and all related software to the latest versions. Keeping software up-to-date reduces the risk of vulnerabilities being exploited by attackers to extract stored credentials or session cookies. |
| M1018 | User Account Management |
Implement strict user account management policies to prevent unnecessary accounts from accessing sensitive systems. Regularly audit user accounts to identify and disable inactive accounts that may be targeted by attackers to extract credentials or gain unauthorized access. |
| M1017 | User Training |
Provide user training on secure practices for managing credentials, including avoiding storing sensitive passwords in browsers and using password managers securely. Users should also be educated on identifying phishing attempts that could steal session cookies or credentials. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may acquire user credentials from third-party password managers. [1] Analytic 1 - Commands indicating credential searches in password managers.
|
| DS0022 | File | File Access |
Monitor file reads that may acquire user credentials from third-party password managers.[1] Analytic 1 - Unauthorized access to password manager files.
|
| DS0009 | Process | OS API Execution |
Monitor for API calls that may search for common password storage locations to obtain user credentials. Analytic 1 - Suspicious API calls related to password manager access.
|
| Process Access |
Monitor process being accessed that may acquire user credentials from third-party password managers.[1] Analytic 1 - Unauthorized process access indicating credential searches in password managers.
|