MITRE ATT&CKsub-technique

T1555.005 Password Managers

Published 2021-01-22 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Linux, macOS, Windows
Version
1.1
Created
2021-01-22

Description

Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk. Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory. Adversaries may extract credentials from memory via Exploitation for Credential Access. Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1555 Credentials from Password Stores technique

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (5)

  • M1054 Software Configuration mitigation
  • M1051 Update Software mitigation
  • M1017 User Training mitigation
  • M1018 User Account Management mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (13)

  • S9043 Mini Shai-Hulud software (malware)
  • G1053 Storm-0501 group
  • S1245 InvisibleFerret software (malware)
  • G1048 UNC3886 group
  • G1015 Scattered Spider group
  • C0014 Operation Wocao campaign
  • G1004 LAPSUS$ group
  • S0652 MarkiRAT software (malware)
  • G0119 Indrik Spider group
  • G0117 Fox Kitten group
  • S0266 TrickBot software (malware)
  • S0279 Proton software (malware)
  • G0027 Threat Group-3390 group

Referenced by Compliance · mitigates (13)

  • CIS-18.3 Remediate Penetration Test Findings CIS Safeguard v8.1
  • CIS-4.11 Enforce Remote Wipe Capability on Portable End-User Devices CIS Safeguard v8.1
  • CIS-6.2 Establish an Access Revoking Process CIS Safeguard v8.1
  • CIS-7.4 Perform Automated Application Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References