Detect Password Managers in Sumo Logic CSE
Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials in an encrypted database, typically accessible after providing a master password. Once the database is unlocked, credentials may be copied to memory. Adversaries may extract the master password or plain-text credentials from memory, brute-force the master password, exploit vulnerabilities (e.g., CVE-2019-3610, CVE-2023-32784 KeePass), or directly exfiltrate password manager database files (.kdbx, .psafe3, .agilekeychain, .1pif) for offline cracking.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Sub-technique
- T1555.005 Password Managers
- Canonical reference
- https://attack.mitre.org/techniques/T1555/005/
Sumo Detection Query
(_sourceCategory=*windows*sysmon* OR _sourceCategory=*endpoint*)
| parse regex "(?i)Image:\s*(?P<Image>[^\r\n]+)" nodrop
| parse regex "(?i)CommandLine:\s*(?P<CommandLine>[^\r\n]+)" nodrop
| parse regex "(?i)TargetFilename:\s*(?P<TargetFile>[^\r\n]+)" nodrop
| parse regex "(?i)ParentImage:\s*(?P<ParentImage>[^\r\n]+)" nodrop
| parse regex "(?i)User:\s*(?P<UserName>[^\r\n]+)" nodrop
| parse regex "(?i)Computer:\s*(?P<ComputerName>[^\r\n]+)" nodrop
| eval PMToolMatch = if(
matches(CommandLine, "(?i)(keethief|keepass2john|kpcli|Find-KeePassConfig|Get-KeePassDatabaseKey|KeePassHax)")
OR matches(Image, "(?i)(keethief|keepass2john)"),
1, 0
)
| eval PMFileAccess = if(
matches(TargetFile, "(?i)(\.kdbx|\.kdb|\.psafe3|\.agilekeychain|\.1pif|1Password\.sqlite|KeePass\.config\.xml|LastPass\.sqlite)")
AND !matches(Image, "(?i)(KeePass\.exe|1Password\.exe|LastPass\.exe|Bitwarden\.exe|Dashlane\.exe|RoboForm\.exe)"),
1, 0
)
| eval PMMemoryDump = if(
matches(CommandLine, "(?i)(procdump.{0,30}keepass|minidump.{0,30}keepass|comsvcs.{0,30}keepass)"),
1, 0
)
| eval SuspicionScore = (PMToolMatch * 3) + (PMFileAccess * 2) + (PMMemoryDump * 3)
| where SuspicionScore > 0
| fields _messageTime, ComputerName, UserName, Image, CommandLine, TargetFile, ParentImage, PMToolMatch, PMFileAccess, PMMemoryDump, SuspicionScore
| sort by SuspicionScore desc, _messageTime descDetects password manager credential theft in Sumo Logic by parsing Sysmon (EventCode 1 process create, EventCode 11 file create) fields via regex extraction and computing a weighted suspicion score. Scores 3 points for known attack tool names in command lines or image paths, 2 points for password database file access by unauthorized processes, and 3 points for memory dumping commands targeting KeePass.
Data Sources
Required Tables
False Positives & Tuning
- Automated IT asset management or configuration management tools (Ansible, Chef, SCCM) that enumerate installed password managers and log process names matching the tool detection patterns during inventory runs
- Portable or non-standard installation paths of legitimate password managers (e.g., KeePass Portable from a USB drive running as 'KeePass-2.57.exe') that don't match the exact exclusion regex and trigger PMFileAccess alerts
- Security awareness training platforms that simulate credential theft attacks using renamed or obfuscated versions of keepass2john or keethief as part of phishing simulation campaigns
Other platforms for T1555.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy KeePass database file for offline cracking
Expected signal: Sysmon Event ID 1: cmd.exe with dir searching for .kdbx files. Sysmon Event ID 11: FileCreate for the copied .kdbx file in %TEMP%. DeviceFileEvents showing file copy from original location.
- Test 2Extract KeePass master key with KeeThief
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'KeeThief' and 'Get-KeePassDatabaseKey'. PowerShell ScriptBlock Log Event ID 4104 with KeeThief module contents. Sysmon Event ID 10: Process Access targeting KeePass.exe.
- Test 3Memory dump of KeePass process with procdump
Expected signal: Sysmon Event ID 1: procdump.exe targeting KeePass.exe. Sysmon Event ID 10: Process Access with GrantedAccess indicating memory read on KeePass.exe. Sysmon Event ID 11: FileCreate for the .dmp file.
References (6)
- https://attack.mitre.org/techniques/T1555/005/
- https://github.com/GhostPack/KeeThief
- https://www.ise.io/casestudies/password-manager-hacking/
- https://nvd.nist.gov/vuln/detail/CVE-2023-32784
- https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.005/T1555.005.md
Unlock Pro Content
Get the full detection package for T1555.005 including response playbook, investigation guide, and atomic red team tests.