Detect Credentials from Password Stores in Google Chronicle
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Canonical reference
- https://attack.mitre.org/techniques/T1555/
YARA-L Detection Query
rule t1555_credentials_from_password_stores {
meta:
author = "Argus Detection Engineering"
description = "Detects execution of credential harvesting tools or commands targeting password stores (T1555)"
mitre_attack_tactic = "Credential Access"
mitre_attack_technique = "T1555"
severity = "HIGH"
confidence = "HIGH"
version = "1.0"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
(
re.regex($e.target.process.file.full_path,
`(?i)(mimikatz|lazagne|credentialfileview|vaultpasswordview|netpass\.exe|keethief|dumperts|browserpassview|webbrowserpassview|mailpassview|chromiumpassworddecryptor|creddump)`)
or re.regex($e.target.process.command_line,
`(?i)(cmdkey\s+/list|vaultcmd\s+/listcreds|security\s+dump-keychain|security\s+find-generic-password|security\s+find-internet-password|rundll32.*keymgr\.dll|CryptUnprotectData|CredEnumerateA|CredEnumerateW|SecKeychainFindInternetPassword|dpapi::cred|vault::list|vault::cred)`)
or re.regex($e.principal.process.file.full_path,
`(?i)(mimikatz|lazagne|credentialfileview|vaultpasswordview|netpass\.exe|keethief|dumperts|browserpassview|webbrowserpassview|mailpassview|chromiumpassworddecryptor|creddump)`)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting password store credential harvesting via PROCESS_LAUNCH UDM events. Matches on the target process full path and command line using regex for known tool names and credential enumeration API calls/CLI patterns. Also checks parent process path to catch child processes spawned by known tools. Uses UDM fields principal.process (parent) and target.process (spawned process).
Data Sources
Required Tables
False Positives & Tuning
- Privileged Access Workstation (PAW) credential vault agents that legitimately call CredEnumerateW during session setup for just-in-time access workflows.
- macOS MDM enrollment processes that use `security find-internet-password` to retrieve proxy credentials from keychain during device provisioning.
- SIEM/SOAR integration agents (Splunk SOAR, Palo Alto XSOAR) that spawn credential retrieval subprocesses when connecting to managed password stores.
Other platforms for T1555
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Enumerate Windows Credential Manager with cmdkey
Expected signal: Sysmon Event ID 1: Process Create with Image=cmdkey.exe, CommandLine='cmdkey /list'. Security Event ID 4688 with same details if command line auditing is enabled.
- Test 2 Enumerate Windows Vault with vaultcmd
Expected signal: Sysmon Event ID 1: Process Create with Image=vaultcmd.exe, CommandLine containing '/listcreds'. Security Event ID 4688 with command line details.
- Test 3 Dump macOS Keychain credentials
Expected signal: macOS Unified Log: process creation for /usr/bin/security with arguments 'dump-keychain -d'. Endpoint Security Framework (ESF) events for Keychain access. EDR telemetry showing security binary execution with dump-keychain argument.
Response Playbook
Triage
- Identify the specific credential store being targeted (Windows Credential Manager, Keychain, browser store, password manager, cloud secrets)
- Determine the tool or command used — is it a known credential theft tool (Mimikatz, LaZagne) or a native OS utility being abused?
- Check the user context — is this a privileged account, service account, or standard user?
- Review the parent process chain — how was the credential access tool launched?
- Correlate with network activity — are there outbound connections suggesting exfiltration of harvested credentials?
- Check for lateral movement indicators following the credential access event
Containment
- Isolate the affected endpoint immediately if a known credential dumping tool is confirmed
- Reset passwords for all accounts that may have had credentials stored on the compromised system
- Revoke active sessions and tokens for potentially compromised accounts
- Block the credential theft tool hash at the EDR level across the environment
- If cloud secrets were accessed, rotate all affected API keys and secrets immediately
Evidence Collection
- Process creation logs (Sysmon Event ID 1, Security Event ID 4688) for the credential access tool and its parent chain
- File access logs for credential store files (Login Data, Keychain files, .vcrd files, .kdbx files)
- Network connection logs for outbound data transfer following credential access
- PowerShell ScriptBlock Logging (Event ID 4104) if PowerShell-based credential tools were used
- Memory dumps of suspicious processes for credential material analysis
- Cloud audit logs (CloudTrail, GCP Audit, Azure Activity Log) if cloud secrets were targeted
Escalation Criteria
- !Known credential theft tool (Mimikatz, LaZagne) confirmed running on a production system
- !Multiple credential stores accessed in rapid succession on the same host
- !Credential access followed by lateral movement to other systems
- !Cloud secrets manager accessed from an unexpected identity or IP address
- !Evidence of credential exfiltration to external destinations
Investigation Guide
Related Techniques
Forensic Artifacts
- >
File System: %APPDATA%\Local\Google\Chrome\User Data\Default\Login Data (Chrome credential database) - >
File System: ~/Library/Keychains/login.keychain-db (macOS Login Keychain) - >
File System: %SYSTEMDRIVE%\Users\<user>\AppData\Local\Microsoft\Credentials\ (Windows Credential Manager) - >
File System: %SYSTEMDRIVE%\Users\<user>\AppData\Local\Microsoft\Vault\ (Windows Vault files) - >
Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication (credential providers) - >
Event Log: Security Event ID 4663 (file access auditing on credential store files) - >
Event Log: Security Event ID 4688 (process creation with command line) - >
Cloud: AWS CloudTrail GetSecretValue events, Azure Key Vault audit logs
Tuning Guidance
This parent-level detection is intentionally broad and should be tuned per environment. Start by establishing a baseline of legitimate credential store access — sysadmins, helpdesk tools, and password manager applications will generate noise. Create allowlists for known-good parent processes that legitimately access credential stores (e.g., browsers accessing their own Login Data, Keychain Access.app). For high-fidelity alerts, combine credential store access with other suspicious indicators like encoded commands, network connections to external IPs, or follow-on lateral movement. Consider deploying sub-technique-specific detections for focused coverage.
Hunting Queries
Hunt for accounts repeatedly querying credential stores using native OS commands. Frequent use of cmdkey, vaultcmd, or Keychain security commands may indicate systematic credential harvesting.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("cmdkey", "vaultcmd", "security dump-keychain", "security find-generic-password", "dpapi::cred", "vault::list")
| summarize Count=count(), Devices=dcount(DeviceName) by AccountName, FileName
| where Count > 2
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*cmdkey*" OR CommandLine="*vaultcmd*" OR CommandLine="*dump-keychain*" OR CommandLine="*find-generic-password*" OR CommandLine="*dpapi::cred*" OR CommandLine="*vault::list*")
| stats count as Count, dc(host) as Devices by User, Image
| where Count > 2
| sort - CountHunt for direct file access to credential store databases. Processes reading Chrome Login Data, Firefox logins.json, macOS keychain files, or KeePass databases outside of their normal application context may indicate credential theft.
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("Login Data", "logins.json", "key3.db", "key4.db", "login.keychain", "Credentials", ".kdbx", ".psafe3")
| where ActionType in ("FileRead", "FileModified", "FileCopied")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (TargetFilename="*Login Data*" OR TargetFilename="*logins.json*" OR TargetFilename="*key3.db*" OR TargetFilename="*key4.db*" OR TargetFilename="*login.keychain*" OR TargetFilename="*.kdbx*" OR TargetFilename="*.psafe3*")
| table _time, host, User, Image, TargetFilename
| sort - _timeHunt for known credential theft tools being executed. Detects common offensive security tools and Mimikatz-specific module commands used to dump credentials from various password stores.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has_any ("mimikatz", "lazagne", "keethief", "credentialfileview", "vaultpasswordview", "browserpassview")
or ProcessCommandLine has_any ("sekurlsa::", "dpapi::", "vault::cred", "lsadump::")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*mimikatz*" OR Image="*lazagne*" OR Image="*keethief*" OR Image="*credentialfileview*" OR CommandLine="*sekurlsa::*" OR CommandLine="*dpapi::*" OR CommandLine="*vault::cred*" OR CommandLine="*lsadump::*")
| table _time, host, User, Image, CommandLine, ParentImage
| sort - _timeAtomic Red Team Tests
Uses the native Windows cmdkey utility to list all stored credentials in Windows Credential Manager. This is a common reconnaissance step used by adversaries after initial access to discover reusable credentials.
Command
cmdkey /listExpected Telemetry
Sysmon Event ID 1: Process Create with Image=cmdkey.exe, CommandLine='cmdkey /list'. Security Event ID 4688 with same details if command line auditing is enabled.
Expected Detection
Alert fires on 'cmdkey /list' command pattern match in both KQL and SPL queries.
Uses vaultcmd.exe to list credential lockers and enumerate stored credentials in Windows Vault. Adversaries like OilRig and Stealth Falcon have used similar techniques to harvest stored credentials.
Command
vaultcmd /listcreds:"Windows Credentials" /allExpected Telemetry
Sysmon Event ID 1: Process Create with Image=vaultcmd.exe, CommandLine containing '/listcreds'. Security Event ID 4688 with command line details.
Expected Detection
Alert fires on 'vaultcmd /listcreds' pattern match. KQL and SPL both flag this credential enumeration command.
Uses the macOS security command-line utility to dump all credentials from the user's Login Keychain. Requires the user's login password. Tools like Empire and LaZagne use this same command for credential harvesting on macOS.
Command
security dump-keychain -d ~/Library/Keychains/login.keychain-dbExpected Telemetry
macOS Unified Log: process creation for /usr/bin/security with arguments 'dump-keychain -d'. Endpoint Security Framework (ESF) events for Keychain access. EDR telemetry showing security binary execution with dump-keychain argument.
Expected Detection
Alert fires on 'security dump-keychain' pattern match. The -d flag indicates credential decryption attempt.