MITRE ATT&CKtechnique

T1555 Credentials from Password Stores

Published 2020-02-11 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
IaaS, Linux, macOS, Windows
Version
1.2
Created
2020-02-11

Description

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Related

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1051 Update Software mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · subtechnique of (6)

  • T1555.006 Cloud Secrets Management Stores sub-technique
  • T1555.005 Password Managers sub-technique
  • T1555.004 Windows Credential Manager sub-technique
  • T1555.001 Keychain sub-technique
  • T1555.002 Securityd Memory sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique

Referenced by MITRE ATT&CK · uses (42)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9022 MirrorStealer software (malware)
  • S1246 BeaverTail software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1207 XLoader software (malware)
  • S1156 Manjusaka software (malware)
  • S1146 MgBot software (malware)
  • G1026 Malteiro group
  • S1122 Mispadu software (malware)
  • S1111 DarkGate software (malware)
  • G1017 Volt Typhoon group
  • C0024 SolarWinds Compromise campaign
  • G0120 Evilnum group
  • S0526 KGH_SPY software (malware)
  • S0484 Carberp software (malware)
  • S0447 Lokibot software (malware)
  • S0435 PLEAD software (malware)
  • G0096 APT41 group
  • S0378 PoshC2 software (tool)
  • S0373 Astaroth software (malware)
  • G0087 APT39 group
  • S0349 LaZagne software (tool)
  • G0082 APT38 group
  • S0331 Agent Tesla software (malware)
  • G0077 Leafminer group
  • G1001 HEXANE group
  • S0262 QuasarRAT software (tool)
  • G0064 APT33 group
Show all 42 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-150 Collect Data from Common Resource Locations attack pattern

Referenced by Compliance · mitigates (10)

  • CIS-7.4 Perform Automated Application Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References