Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Credential Access/ T1555.005

T1555.005Password Managers

T1555.005 — Password Managers is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 6 detection use cases covering it and 2 threat-intel articles citing it.

Credential Access
View on the matrix → Filter Detection Library MITRE official spec ↗
6Use cases
2Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1555 · Credentials from Password Stores

Use cases covering this technique (6)

Azure Key Vault keys / secrets read Internal actions · alerting DD Linux Auditd Find Credentials From Password Managers ESCU actions · alerting P Linux Auditd Find Credentials From Password Stores ESCU actions · alerting P Windows Password Managers Discovery ESCU actions · hunting P [LLM] Python Process Reading Multi-Cloud Credential Stores (durabletask Stealer Stage) Bespoke actions · hunting DSPDDCS [LLM] Single process fan-out reading cloud, Vault, SSH and AI-tool credential files Bespoke actions · hunting DSPCS

Articles citing this technique (2)

high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-422
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-423