T1555 Credentials from Password Stores

Technique: T1555
Tactics: Credential Access
Research, 90 days: 3
KEV CVEs mapped: 9
SigmaHQ rules: 8
Elastic, Splunk: 36
thrunt rules: 0
Active families: ACRStealer, AgentTesla, Formbook, Lumma, Stealc, Vidar
Upstream: https://attack.mitre.org/techniques/T1555

MITRE description

Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
2026-09-24 FortiGuard Labs: Uncovering a SectopRAT Variant Embedded in Legitimate Software
2026-08-23 Darktrace: When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar

Detection coverage

SigmaHQ community rules

PUA - AWS TruffleHog Execution (core)
DPAPI Backup Keys And Certificate Export Activity IOC (core)
Dump Credentials from Windows Credential Manager With PowerShell (core)
Enumerate Credentials from Windows Credential Manager With PowerShell (core)
HackTool - WinPwn Execution - ScriptBlock (core)
HackTool - SecurityXploded Execution (core)
HackTool - WinPwn Execution (core)
Suspicious Serv-U Process Pattern (core)

Elastic and Splunk rules

GenAI Process Accessing Sensitive Files (elastic)
Potential Secret Scanning via Gitleaks (elastic)
Multiple Cloud Secrets Accessed by Source Address (elastic)
Multiple Credential Access by VS Code or Cursor IDE Descendant (elastic)
Credential Access via TruffleHog Execution (elastic)
First Time Seen AWS Secret Value Accessed in Secrets Manager (elastic)
AWS Secrets Manager Rapid Secrets Retrieval (elastic)
AWS Systems Manager SecureString Parameter Request with Decryption Flag (elastic)
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity (elastic)
Microsoft Foundry Keys or Connection Secrets Accessed by New Principal (elastic)
Azure Storage Account Keys Accessed by Privileged User (elastic)
Azure Key Vault Excessive Secret or Key Retrieved (elastic)
Azure Key Vault Unusual Secret Key Usage (elastic)
Azure Key Vault Multi-Vault Secret Retrieval Burst by Application (elastic)
CyberArk Privileged Access Security Recommended Monitor (elastic)
Keychain CommandLine Interaction via Unsigned or Untrusted Process (elastic)
Dumping of Keychain Content via Security Command (elastic)
Keychain Password Retrieval via Command Line (elastic)
First Time Python Accessed Sensitive Credential Files (elastic)
Suspicious Web Browser Sensitive File Access (elastic)
SystemKey Access via Command Line (elastic)
Browser Process Spawned from an Unusual Parent (elastic)
Potential Credential Access via Trusted Developer Utility (elastic)
Creation or Modification of Domain Backup DPAPI private key (elastic)
Potential Invoke-Mimikatz PowerShell Script (elastic)

Showing 25 of 36.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.