T1555

IaaS Linux macOS Windows

Credentials from Password Stores

Description

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Sub-techniques

T1555.001 — Keychain T1555.002 — Securityd Memory T1555.003 — Credentials from Web Browsers T1555.004 — Windows Credential Manager T1555.005 — Password Managers T1555.006 — Cloud Secrets Management Stores