Detect Credentials from Password Stores in Sumo Logic CSE

Related Techniques

Forensic Artifacts

• >File System: %APPDATA%\Local\Google\Chrome\User Data\Default\Login Data (Chrome credential database)
• >File System: ~/Library/Keychains/login.keychain-db (macOS Login Keychain)
• >File System: %SYSTEMDRIVE%\Users\<user>\AppData\Local\Microsoft\Credentials\ (Windows Credential Manager)
• >File System: %SYSTEMDRIVE%\Users\<user>\AppData\Local\Microsoft\Vault\ (Windows Vault files)
• >Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication (credential providers)
• >Event Log: Security Event ID 4663 (file access auditing on credential store files)
• >Event Log: Security Event ID 4688 (process creation with command line)
• >Cloud: AWS CloudTrail GetSecretValue events, Azure Key Vault audit logs

Tuning Guidance

This parent-level detection is intentionally broad and should be tuned per environment. Start by establishing a baseline of legitimate credential store access — sysadmins, helpdesk tools, and password manager applications will generate noise. Create allowlists for known-good parent processes that legitimately access credential stores (e.g., browsers accessing their own Login Data, Keychain Access.app). For high-fidelity alerts, combine credential store access with other suspicious indicators like encoded commands, network connections to external IPs, or follow-on lateral movement. Consider deploying sub-technique-specific detections for focused coverage.

Hunt for accounts repeatedly querying credential stores using native OS commands. Frequent use of cmdkey, vaultcmd, or Keychain security commands may indicate systematic credential harvesting.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("cmdkey", "vaultcmd", "security dump-keychain", "security find-generic-password", "dpapi::cred", "vault::list")
| summarize Count=count(), Devices=dcount(DeviceName) by AccountName, FileName
| where Count > 2
| sort by Count desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*cmdkey*" OR CommandLine="*vaultcmd*" OR CommandLine="*dump-keychain*" OR CommandLine="*find-generic-password*" OR CommandLine="*dpapi::cred*" OR CommandLine="*vault::list*")
| stats count as Count, dc(host) as Devices by User, Image
| where Count > 2
| sort - Count

Hunt for direct file access to credential store databases. Processes reading Chrome Login Data, Firefox logins.json, macOS keychain files, or KeePass databases outside of their normal application context may indicate credential theft.

DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("Login Data", "logins.json", "key3.db", "key4.db", "login.keychain", "Credentials", ".kdbx", ".psafe3")
| where ActionType in ("FileRead", "FileModified", "FileCopied")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (TargetFilename="*Login Data*" OR TargetFilename="*logins.json*" OR TargetFilename="*key3.db*" OR TargetFilename="*key4.db*" OR TargetFilename="*login.keychain*" OR TargetFilename="*.kdbx*" OR TargetFilename="*.psafe3*")
| table _time, host, User, Image, TargetFilename
| sort - _time

Hunt for known credential theft tools being executed. Detects common offensive security tools and Mimikatz-specific module commands used to dump credentials from various password stores.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has_any ("mimikatz", "lazagne", "keethief", "credentialfileview", "vaultpasswordview", "browserpassview")
    or ProcessCommandLine has_any ("sekurlsa::", "dpapi::", "vault::cred", "lsadump::")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*mimikatz*" OR Image="*lazagne*" OR Image="*keethief*" OR Image="*credentialfileview*" OR CommandLine="*sekurlsa::*" OR CommandLine="*dpapi::*" OR CommandLine="*vault::cred*" OR CommandLine="*lsadump::*")
| table _time, host, User, Image, CommandLine, ParentImage
| sort - _time