// MITRE ATT&CK
T1555 · Credentials from Password Stores
Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that ...
¿Cómo detectarlo y mitigarlo?
La detección de Credentials from Password Stores parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (6)
T1555.001
Keychain T1555.002
Securityd Memory T1555.003
Credentials from Web Browsers T1555.004
Windows Credential Manager T1555.005
Password Managers T1555.006
Cloud Secrets Management Stores
Keychain T1555.002
Securityd Memory T1555.003
Credentials from Web Browsers T1555.004
Windows Credential Manager T1555.005
Password Managers T1555.006
Cloud Secrets Management Stores
Técnicas relacionadas
T1557
Adversary-in-the-Middle T1110.001
Password Guessing T1003
OS Credential Dumping T1539
Steal Web Session Cookie T1003.002
Security Account Manager T1552.005
Cloud Instance Metadata API T1555.002
Securityd Memory T1110.002
Password Cracking
Adversary-in-the-Middle T1110.001
Password Guessing T1003
OS Credential Dumping T1539
Steal Web Session Cookie T1003.002
Security Account Manager T1552.005
Cloud Instance Metadata API T1555.002
Securityd Memory T1110.002
Password Cracking
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.