| ID | Name |
|---|---|
| T1555.001 | Keychain |
| T1555.002 | Securityd Memory |
| T1555.003 | Credentials from Web Browsers |
| T1555.004 | Windows Credential Manager |
| T1555.005 | Password Managers |
| T1555.006 | Cloud Secrets Management Stores |
Adversaries may acquire user credentials from third-party password managers.[1] Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.[1]
Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.[2][3] Adversaries may extract credentials from memory via Exploitation for Credential Access.[4]
Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.[5]
| ID | Name | Description |
|---|---|---|
| G0117 | Fox Kitten |
Fox Kitten has used scripts to access credential information from the KeePass database.[6] |
| G0119 | Indrik Spider |
Indrik Spider has accessed and exported passwords from password managers.[7] |
| S1245 | InvisibleFerret |
InvisibleFerret has utilized the command |
| G1004 | LAPSUS$ |
LAPSUS$ has accessed local password managers and databases to obtain further credentials from a compromised network.[10] |
| S0652 | MarkiRAT |
MarkiRAT can gather information from the Keepass password manager.[11] |
| C0014 | Operation Wocao |
During Operation Wocao, threat actors accessed and collected credentials from password managers.[2] |
| S0279 | Proton | |
| G1015 | Scattered Spider |
Scattered Spider has searched for credentials in password vaults and Privileged Access Management (PAM) solutions including HashiCorp Vault.[13][14] |
| G1053 | Storm-0501 |
Storm-0501 has stolen credentials contained in the password manager Keepass by utilizing Find-KeePassConfig.ps1.[15] |
| G0027 | Threat Group-3390 |
Threat Group-3390 obtained a KeePass database from a compromised host.[16] |
| S0266 | TrickBot |
TrickBot can steal passwords from the KeePass open source password manager.[5] |
| G1048 | UNC3886 |
UNC3886 has targeted KeyPass password database files for credential access.[17] |
| ID | Mitigation | Description |
|---|---|---|
| M1027 | Password Policies |
Refer to NIST guidelines when creating password policies for master passwords.[18] |
| M1054 | Software Configuration |
Consider re-locking password managers after a short timeout to limit the time plaintext credentials live in memory from decrypted databases. |
| M1051 | Update Software |
Regularly update web browsers, password managers, and all related software to the latest versions. Keeping software up-to-date reduces the risk of vulnerabilities being exploited by attackers to extract stored credentials or session cookies. |
| M1018 | User Account Management |
Implement strict user account management policies to prevent unnecessary accounts from accessing sensitive systems. Regularly audit user accounts to identify and disable inactive accounts that may be targeted by attackers to extract credentials or gain unauthorized access. |
| M1017 | User Training |
Provide user training on secure practices for managing credentials, including avoiding storing sensitive passwords in browsers and using password managers securely. Users should also be educated on identifying phishing attempts that could steal session cookies or credentials. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0597 | Detect Unauthorized Access to Password Managers | AN1641 |
Detection of suspicious access to password manager processes (KeePass, 1Password, LastPass, Bitwarden) through abnormal process injection, memory reads, or command-line usage of vault-related DLLs. Correlates process creation with OS API calls and file access to vault databases (.kdbx, .opvault, .ldb). |
| AN1642 |
Suspicious access to password manager vaults (KeePassXC, gnome-keyring, pass) via memory scraping or unauthorized file reads. Detects unusual command execution involving gdb/strace attached to password manager processes. |
||
| AN1643 |
Detection of password manager database access (1Password .opvault, LastPass caches, KeePass .kdbx) outside expected parent processes. Identifies memory scraping attempts via suspicious API calls or tools attaching to password manager processes. |