T1555.005 Password Managers

Technique: T1555.005
Tactics: Credential Access
Research, 90 days: 1
KEV CVEs mapped: 0
SigmaHQ rules: 1
Elastic, Splunk: 3
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1555/005

MITRE description

Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019) Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation: NVD CVE-2019-3610) Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT

Detection coverage

SigmaHQ community rules

Remote Thread Created In KeePass.EXE (core)

Elastic and Splunk rules

Linux Auditd Find Credentials From Password Managers (splunk)
Linux Auditd Find Credentials From Password Stores (splunk)
Windows Password Managers Discovery (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.