T1555 — Credentials from Password Stores

# T1555 - Credentials from Password Stores

## SOC Recommendation
Investigate Credentials from Password Stores activity in the context of Credential Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
let CredentialStoreFiles = dynamic([
    "Login Data",
    "logins.json",
    "key4.db"
]);
let BrowserProcesses = dynamic([
    "chrome.exe",
    "msedge.exe",
    "firefox.exe",
    "brave.exe"
]);
DeviceFileEvents
| where TimeGenerated >= ago(1d)
| where FileName in~ (CredentialStoreFiles)
| where ActionType in~ ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessFileName !in~ (BrowserProcesses)
| project
    TimeGenerated,
    DeviceName,
    DeviceId,
    AccountName = RequestAccountName,
    FileName,
    FolderPath,
    ActionType,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessSHA256
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
let loginRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login?user=" and Status == 403;
let recCount = iff((toscalar(loginRec | count) > 10), 1, 0);
loginRec | take recCount
```
```kql
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "Password Exfiltration over SCIM application"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
```

## Escalation Criteria
- Credentials from Password Stores activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1555.json
• /api/recommendations/T1555.json
• /api/d3fend/T1555.json
• /api/mappings/T1555.json
• /api/confluence/T1555.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1555.json

Response:

{
  "technique_id": "T1555",
  "name": "Credentials from Password Stores",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Credential Access"
  ],
  "platforms": [
    "IaaS",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults...",
  "soc_recommendation": "Investigate Credentials from Password Stores activity in the context of Credential Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CF",
      "name": "Content Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Content Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed credentials from password stores activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Browser Credential Store File Access\" -- Flags a non-browser process reading or copying the local browser credential store files (Chrome/Edge Login Data, Firefox logins.json)."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CA-003 — Browser Credential Store File Access",
        "description": "Flags a non-browser process reading or copying the local browser credential store files (Chrome/Edge Login Data, Firefox logins.json). (Source: Bell Integration baseline detection library, mapped via sub-technique T1555.003.)",
        "query": "let CredentialStoreFiles = dynamic([\n    \"Login Data\",\n    \"logins.json\",\n    \"key4.db\"\n]);\nlet BrowserProcesses = dynamic([\n    \"chrome.exe\",\n    \"msedge.exe\",\n    \"firefox.exe\",\n    \"brave.exe\"\n]);\nDeviceFileEvents\n| where TimeGenerated >= ago(1d)\n| where FileName in~ (CredentialStoreFiles)\n| where ActionType in~ (\"FileCreated\", \"FileModified\", \"FileRenamed\")\n| where InitiatingProcessFileName !in~ (BrowserProcesses)\n| project\n    TimeGenerated,\n    DeviceName,\n    DeviceId,\n    AccountName = RequestAccountName,\n    FileName,\n    FolderPath,\n    ActionType,\n    InitiatingProcessFileName,\n    InitiatingProcessCommandLine,\n    InitiatingProcessSHA256\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "d951d64d-0ecd-4675-8c79-6c870d5f72ac — API - Password Cracking",
        "description": "42Crunch API protection against password cracking' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let loginRec = FortyTwoCrunchAPIProtection\n| where TimeGenerated >= ago(5m) \n| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid\n| where UriPath has \"/api/login?user=\" and Status == 403;\nlet recCount = iff((toscalar(loginRec | count) > 10), 1, 0);\nloginRec | take recCount"
      },
      {
        "name": "2e3c4ad5-8cb3-4b46-88ff-a88367ee7eaa — Password Exfiltration over SCIM application",
        "description": "This rule detects suspicious sync events that occurred to applications using SCIM for user provisioning. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "Authomize_v2_CL\n| where ingestion_time() >= ago(30m)\n| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s\n| where Policy has \"Password Exfiltration over SCIM application\"\n| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "472b4944-d810-43cf-83dc-7d080ae1b8dd — Multiple Cloud Secrets Accessed by Source Address",
        "description": "(ESQL) This rule detects authenticated sessions accessing secret stores across multiple environments from the same source address within a short period of time, including cloud providers (AWS, GCP, Azure) and Kubernetes clusters... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-azure.platformlogs-*, logs-aws.cloudtrail-*, logs-gcp.audit-*, logs-kubernetes.audit_logs-* METADATA _id, _version, _index \n| WHERE \n  ( \n    /* AWS Secrets Manager */ \n    (data_stream.dataset == \"aws.cloudtrail\" AND event.action == \"GetSecretValue\") OR \n    \n    // Azure Key Vault (platform logs)\n    (data_stream.dataset == \"azure.platformlogs\" AND event.action IN (\"SecretGet\", \"KeyGet\")) or \n    \n    /* Google Secret Manager */ \n    (data_stream.dataset IN (\"googlecloud.audit\", \"gcp.audit\") AND \n     event.action IN (\"google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion\", \"google.cloud.secretmanager.v1.SecretManagerService.GetSecretRequest\")) OR \n\n    /* Kubernetes Secrets */\n    (data_stream.dataset == \"kubernetes.audit_logs\" AND kubernetes.audit.objectRef.resource == \"secrets\" AND kubernetes.audit.verb IN (\"get\", \"list\"))\n\n   ) AND source.ip IS NOT NULL\n\n// Cloud vendor label based on dataset\n| EVAL Esql.cloud_vendor = CASE(\n    data_stream.dataset == \"aws.cloudtrail\", \"aws\",\n    data_stream.dataset == \"azure.platformlogs\", \"azure\",\n    data_stream.dataset IN (\"googlecloud.audit\",\"gcp.audit\"), \"gcp\",\n    data_stream.dataset == \"kubernetes.audit_logs\", \"k8s\",\n    \"unknown\"\n  )\n// Vendor+tenant label, e.g. aws:123456789012, azure:tenant, gcp:project\n| EVAL Esql.tenant_label = CASE(\n    Esql.cloud_vendor == \"aws\", CONCAT(\"aws:\", cloud.account.id),\n    Esql.cloud_vendor == \"azure\", CONCAT(\"azure:\", cloud.account.id),\n    Esql.cloud_vendor == \"gcp\", CONCAT(\"gcp:\", cloud.account.id),\n    Esql.cloud_vendor == \"k8s\", CONCAT(\"k8s:\", orchestrator.cluster.name),\n    \"unknown\"\n  )\n| WHERE Esql.cloud_vendor != \"unknown\"\n| STATS\n    // Core counts\n    Esql.events_count = COUNT(*),\n    Esql.vendor_count_distinct = COUNT_DISTINCT(Esql.cloud_vendor),\n    // Action & data source context\n    Esql.event_action_values = VALUES(event.action),\n    Esql.data_source_values = VALUES(data_stream.dataset),\n    // Cloud vendor + tenant context\n    Esql.cloud_vendor_values = VALUES(Esql.cloud_vendor),\n    Esql.tenant_label_values = VALUES(Esql.tenant_label),\n    // Hyperscaler-specific IDs\n    Esql.aws_account_id_values = VALUES(CASE(Esql.cloud_vendor == \"aws\", cloud.account.id, \"unknown\")),\n    Esql.azure_tenant_id_values = VALUES(CASE(Esql.cloud_vendor == \"azure\", cloud.account.id, \"unknown\")),\n    Esql.gcp_project_id_values = VALUES(CASE(Esql.cloud_vendor == \"gcp\", cloud.account.id, \"unknown\")),\n    // Generic cloud metadata\n    Esql.cloud_region_values = VALUES(cloud.region),\n    Esql.k8s_namespace_values = VALUES(kubernetes.audit.objectRef.namespace),\n    // Namespace values\n    Esql.data_stream_namespace_values = VALUES(data_stream.namespace), \n    Esql_priv.user_name_values = VALUES(user.name)\n  BY source.ip\n// Require multi-vendor cred-access from same source IP\n| WHERE Esql.vendor_count_distinct >= 2\n| SORT Esql.events_count DESC\n| KEEP Esql.*, Esql_priv.*, source.ip"
      },
      {
        "name": "a1b2c3d4-e5f6-4789-a0b1-c2d3e4f5a6b7 — AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity",
        "description": "(ESQL) Detects when credentials issued through `AssumeRoleWithWebIdentity` for a Kubernetes service account identity are later used for several distinct AWS control-plane actions on the same session access key... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-aws.cloudtrail-*\n| WHERE (event.action == \"AssumeRoleWithWebIdentity\" AND user.name like \"system:serviceaccount:*\")\n  // S3 PutObject/GetObject is too  common in legit pod SA behavior \n  OR (event.action IN (\"ListBuckets\", \"DescribeInstances\", \"GetCallerIdentity\",\n    \"ListUsers\", \"ListRoles\", \"ListAttachedRolePolicies\", \"GetRolePolicy\",\n    \"GetSecretValue\", \"ListSecrets\",\n    \"GetParameters\", \"DescribeParameters\", \"ListKeys\", \"Decrypt\",\n    \"ListFunctions\", \"GetAuthorizationToken\",\n    \"SendCommand\", \"StartSession\",\n    \"CreateUser\", \"CreateAccessKey\", \"AttachRolePolicy\", \"CreateRole\",\n    \"PutRolePolicy\", \"UpdateAssumeRolePolicy\",\n    \"UpdateFunctionCode\", \"UpdateFunctionConfiguration\", \"ModifyInstanceAttribute\",\n    \"StopLogging\", \"DeleteTrail\")\n    AND aws.cloudtrail.user_identity.type == \"AssumedRole\")\n| GROK aws.cloudtrail.response_elements \"accessKeyId=%{NOTSPACE:issued_key_id},\"\n| EVAL access_key = COALESCE(issued_key_id, aws.cloudtrail.user_identity.access_key_id)\n| EVAL is_assume = CASE(event.action == \"AssumeRoleWithWebIdentity\", 1, 0)\n| EVAL is_post_exploit = CASE(event.action != \"AssumeRoleWithWebIdentity\", 1, 0)\n| EVAL phase = CASE(\n    event.action == \"AssumeRoleWithWebIdentity\", \"initial_access\",\n    event.action IN (\"ListBuckets\", \"DescribeInstances\", \"ListUsers\", \"ListRoles\",\n      \"GetCallerIdentity\", \"ListAttachedRolePolicies\", \"GetRolePolicy\",\n      \"ListFunctions\"), \"recon\",\n    event.action IN (\"GetSecretValue\", \"ListSecrets\", \"GetParameters\",\n      \"GetAuthorizationToken\", \"Decrypt\"), \"credential_access\",\n    event.action IN (\"SendCommand\", \"StartSession\"), \"lateral_movement\",\n    event.action IN (\"CreateUser\", \"CreateAccessKey\", \"AttachRolePolicy\",\n      \"CreateRole\", \"PutRolePolicy\", \"UpdateAssumeRolePolicy\",\n      \"UpdateFunctionCode\", \"UpdateFunctionConfiguration\",\n      \"ModifyInstanceAttribute\"), \"persistence\",\n    event.action IN (\"StopLogging\", \"DeleteTrail\"), \"defense_evasion\"\n  )\n| STATS \n    Esql.assume_count = SUM(is_assume),\n    Esql.post_exploit_count = COUNT_DISTINCT(event.action),\n    Esql.attack_phases = VALUES(phase),\n    Esql.event_action_values = VALUES(event.action),\n    Esql.source_ip_values = VALUES(source.ip),\n    Esql.source_as_organization_name_values = VALUES(source.as.organization.name),\n    Esql.user_name_values = VALUES(user.name),\n    Esql.user_agent_original_values = VALUES(user_agent.original),\n    Esql.cloud_account_id_values = VALUES(cloud.account.id),\n    Esql.data_stream_namespace_values = VALUES(data_stream.namespace),\n    Esql.first_seen = MIN(@timestamp),\n    Esql.last_seen = MAX(@timestamp),\n    Esql.total_calls = COUNT(*)\n  BY access_key\n| WHERE access_key is not null and Esql.assume_count >= 1 AND Esql.post_exploit_count >= 3\n| EVAL aws.cloudtrail.user_identity.access_key_id = MV_FIRST(access_key)\n| KEEP aws.cloudtrail.user_identity.access_key_id, Esql.*"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Credentials from Password Stores activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1555 - Credentials from Password Stores Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}