CmdID

CmdID / Techniques

T1555 Credentials from Password Stores

Adversaries may search for common password storage locations to obtain user credentials. MITRE ATT&CK

3 Sigma rules T1555 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1555.001Credentials from Password Stores: Keychain
T1555.003Credentials from Password Stores: Credentials from Web Browsers
T1555.004Credentials from Password Stores: Windows Credential Manager

Sigma rules tagged with it

process creation, the highest levels first
criticalHackTool - SecurityXploded ExecutionFlorian Roth (Nextron Systems) · Windows
highHackTool - WinPwn ExecutionSwachchhanda Shrawan Poudel · Windows
highSuspicious Serv-U Process PatternFlorian Roth (Nextron Systems) · Windows