Detect Windows Credential Manager in Google Chronicle
Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults). Credentials are stored as encrypted .vcrd files under %Systemdrive%\Users\[Username]\AppData\Local\Microsoft\[Vault/Credentials]\. Adversaries may enumerate credentials via vaultcmd.exe, cmdkey.exe, Windows APIs (CredEnumerateA), or extract credential backups via rundll32.exe keymgr.dll KRShowKeyMgr. Tools like Mimikatz (vault::cred, vault::list) and PowerSploit can also harvest Credential Manager contents.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Sub-technique
- T1555.004 Windows Credential Manager
- Canonical reference
- https://attack.mitre.org/techniques/T1555/004/
YARA-L Detection Query
rule t1555_004_windows_credential_manager_access {
meta:
author = "Detection Engineering"
description = "Detects Windows Credential Manager enumeration and harvesting via vaultcmd.exe, cmdkey.exe, rundll32.exe keymgr.dll, Mimikatz vault/dpapi modules, and PowerShell credential dump tools"
mitre_attack_tactic = "Credential Access"
mitre_attack_technique = "T1555.004"
severity = "HIGH"
confidence = "HIGH"
platforms = "Windows"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.principal.hostname = $hostname
(
(
re.regex($e.target.process.file.full_path, `(?i)vaultcmd[.]exe$`) and
re.regex($e.target.process.command_line, `(?i)/(listcreds|list)`)
) or
(
re.regex($e.target.process.file.full_path, `(?i)cmdkey[.]exe$`) and
re.regex($e.target.process.command_line, `(?i)/list`)
) or
(
re.regex($e.target.process.file.full_path, `(?i)rundll32[.]exe$`) and
re.regex($e.target.process.command_line, `(?i)keymgr[.]dll`)
) or
re.regex($e.target.process.command_line, `(?i)(Invoke-WCMDump|vault::cred|vault::list|dpapi::cred|Get-VaultCredential|CredEnumerateA|CredEnumerateW|KRShowKeyMgr)`)
)
condition:
$e
}Google Chronicle YARA-L 2.0 rule detecting Windows Credential Manager access using UDM PROCESS_LAUNCH events. Matches vaultcmd.exe enumeration flags (/listcreds, /list), cmdkey.exe /list, rundll32.exe invoking keymgr.dll for credential backup, Mimikatz vault and dpapi command strings, and PowerShell-based credential harvesting tools via re.regex against UDM process file path and command line fields. Anchors process name matches to end-of-string to prevent false positives from similarly named binaries.
Data Sources
Required Tables
False Positives & Tuning
- Automated IT compliance scripts enumerating stored credentials for audit purposes using vaultcmd or cmdkey on a scheduled basis
- Password migration tooling leveraging keymgr.dll or CredEnumerate APIs to export and transfer credentials during workstation replacement projects
- Security operations teams executing Mimikatz in isolated sandbox or malware analysis lab environments for threat research or training exercises
Other platforms for T1555.004
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate stored credentials with cmdkey
Expected signal: Sysmon Event ID 1: Process Create with Image=cmdkey.exe, CommandLine='cmdkey /list'. Security Event ID 4688 with same details. Security Event ID 5379 if Credential Validation auditing is enabled.
- Test 2Enumerate vault credentials with vaultcmd
Expected signal: Sysmon Event ID 1: Process Create with Image=vaultcmd.exe, CommandLine containing '/listcreds'. Security Event ID 4688 with command line.
- Test 3Export credential backup via keymgr.dll
Expected signal: Sysmon Event ID 1: Process Create with Image=rundll32.exe, CommandLine='rundll32.exe keymgr.dll,KRShowKeyMgr'. The GUI will open for user interaction.
References (6)
- https://attack.mitre.org/techniques/T1555/004/
- https://blog.malwarebytes.com/101/2016/01/the-windows-vaults/
- https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials
- https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credenumeratea
- https://www.passcape.com/windows_password_recovery_vault_explorer
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.004/T1555.004.md
Unlock Pro Content
Get the full detection package for T1555.004 including response playbook, investigation guide, and atomic red team tests.