Credentials from password stores / vaults

Secrets harvested from Keychain, Credential Manager, password managers, cloud vaults

categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1555.004 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1555.004 -Tool atomic -RunId run-2026-10-20-012 -Command 'Invoke-AtomicTest T1555.004 -TestGuids 9c2dd36d-5c8b-4b29-8d72-a11b0d5d7439 -TimeoutSeconds 120'

What our lab measured

partially detected windows · 2026-10-20 · detected in 38s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 1	Windows Credential Manager enumeration: vaultcmd /listcreds (web/vault credential listing)
Sysmon · EID 1	Windows command prompt started by an abnormal process
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
… and 6 more event type(s)

Detection that fired

✓ Wazuh 100402 (level 8) lab rule — Windows Credential Manager enumeration: vaultcmd /listcreds (web/vault credential listing)

Plus 13 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~63843 incidental alerts/hour — tune against this.

Classification

29 values: 13 reviewed, 2 lab-measured, 13 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Confidentiality
Platform	IaaSLinuxmacOSWindows
Environment	CloudOn-premises
Target asset class	Identity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Cloud Service EnumerationCommand ExecutionFile AccessFile MetadataOS API ExecutionProcess AccessProcess Creation

Detection & response

Mitigated by 23

M1017 attack-mitigation
M1018 attack-mitigation
M1021 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1042 attack-mitigation
M1051 attack-mitigation
M1054 attack-mitigation
D3-CF d3fend
D3-CM d3fend
D3-CQ d3fend
D3-DF d3fend
D3-DI d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-RD d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-SCA d3fend
D3-SCF d3fend

Detected by 21

DET0037 attack-detection-strategy
DET0057 attack-detection-strategy
DET0130 attack-detection-strategy
DET0134 attack-detection-strategy
DET0396 attack-detection-strategy
DET0597 attack-detection-strategy
24c77512-782b-448a-8950-eddb0785fc71 sigma
46612ae6-86be-4802-bc07-39b59feb1309 sigma
47147b5b-9e17-4d76-b8d2-7bac24c5ce1b sigma
4b60e527-ec73-4b47-8cb3-f02ad927ca65 sigma
58f50261-c53b-4c88-bd12-1d71f12eda4c sigma
77564cc2-7382-438b-a7f6-395c2ae53b9a sigma
7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2 sigma
851fd622-b675-4d26-b803-14bc7baa517a sigma
a1dfd976-4852-41d4-9507-dc6590a3ccd0 sigma
a4694263-59a8-4608-a3a0-6f8d3a51664c sigma
b120b587-a4c2-4b94-875d-99c9807d6955 sigma
d0dae994-26c6-4d2d-83b5-b3c8b79ae513 sigma
d557dc06-62e8-4468-a8e8-7984124908ce sigma
fc028194-969d-4122-8abe-0470d5b8f12f sigma
100402 wazuh

Tested by 25

124e13e5-d8a1-4378-a6ee-a53cd0c7e369 atomic
1864fdec-ff86-4452-8c30-f12507582a93 atomic
1b83cddb-eaa7-45aa-98a5-85fb0a8807ea atomic
28498c17-57e4-495a-b0be-cc1e36de408b atomic
29d0c390-3cbc-4e4e-a52b-a1350ed836b7 atomic
3d111226-d09a-4911-8715-fe11664f960d atomic
5c32102a-c508-49d3-978f-288f8a9f6617 atomic
6f2c5c87-a4d5-4898-9bd1-47a55ecaf1dd atomic
70422253-8198-4019-b617-6be401b49fce atomic
764ea176-fb71-494c-90ea-72e9d85dce76 atomic
87e88698-621b-4c45-8a89-4eaebdeaabb1 atomic
88e1fa00-bf63-4e5b-a3e1-e2ea51c8cca6 atomic
8c05b133-d438-47ca-a630-19cc464c4622 atomic
9a2915b3-3954-4cce-8c76-00fbf4dbd014 atomic
9c2dd36d-5c8b-4b29-8d72-a11b0d5d7439 atomic
a6a5ec26-a2d1-4109-9d35-58b867689329 atomic
c1402f7b-67ca-43a8-b5f3-3143abedc01b atomic
dc9cd677-c70f-4df5-bd1c-f114af3c2381 atomic
e359627f-2d90-4320-ba5e-b0f878155bbe atomic
e544bbcb-c4e0-4bd0-b614-b92131635f59 atomic
e5e3d639-6ea8-4408-9ecd-d5a286268ca0 atomic
eb8da98a-2e16-4551-b3dd-83de49baa14c atomic
ec1d0b37-f659-4186-869f-31a554891611 atomic
f543635c-1705-42c3-b180-efd6dc6e7ee7 atomic
fa714db1-63dd-479e-a58e-7b2b52ca5997 atomic

Attack relationships

Parent: DPAPI secret theft
Parent: Malware-as-a-service (infostealers)

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-20-012`	partially-detected	atomic	windows	2026-10-20
`run-2026-11-02-018`	detected	atomic	windows	2026-11-02

run-2026-10-20-012 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555.004 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1667 max_level=15 dwell_s=90
run-2026-11-02-018 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555.004 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=30 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/tactics/TA0006/
attack: T1555.001 (primary)
attack: T1555.002
attack: T1555.003
attack: T1555.004
attack: T1555.005
attack: T1555.006

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 338 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 1 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 12 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 13 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0005 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 14 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0006 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 89 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0007 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 9 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0008 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-012 (partially-detected) for T1555.004: no alert matched the expected technique
ev-0009 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-018 (detected): Wazuh rule(s) 100402 fired on T1555.004 within the detonation window
Windows Credential Manager enumeration: vaultcmd /listcreds (web/vault credential listing)