T1555 Credentials from Password Stores — Detection & Response
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system depending on the operating system or application holding the credentials. These locations include the macOS Keychain, Windows Credential Manager, web browser credential stores, and enterprise password managers — all of which can be accessed by malware or an attacker with local system access.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 4+
Threat context
How adversaries use T1555 Credentials from Password Stores — Detection & Response
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system depending on the operating system or application holding the credentials. These locations include the macOS Keychain, Windows Credential Manager, web browser credential stores, and enterprise password managers — all of which can be accessed by malware or an attacker with local system access.
Post-exploitation malware routinely targets browser credential stores and operating system password vaults as a high-yield credential harvesting technique. Infostealer malware families (Redline, Raccoon, Vidar) specifically target Chrome and Firefox SQLite databases containing saved passwords, exfiltrating thousands of credentials per infected host. Enterprise password managers (1Password, Bitwarden, LastPass) are also targeted — successful exfiltration of a password manager vault gives an attacker access to every account managed by the victim.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| Non-Browser Process Reading Chrome Login Data A process other than chrome.exe opens the Chrome 'Login Data' SQLite file — browser credential extraction by potential infostealer. | High | CrowdStrike / SentinelOne |
| Mass Password Manager Vault Item Access A user accesses more than 30 vault items in a 10-minute window — possible vault dump by automated tool or compromised session. | High | 1Password Events API |
| Windows Credential Manager Enumeration via cmdkey cmdkey.exe /list executed by a non-admin user — Credential Manager enumeration tool used by many post-exploitation frameworks. | Medium | CrowdStrike / Windows Event Log |
| Keychain Access from Unexpected Process on macOS A process that is not a known application or system tool attempts to access the macOS Keychain — potential credential harvesting on macOS. | High | CrowdStrike Falcon / Endpoint Telemetry |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1555 Credentials from Password Stores — Detection & Response: frequently asked questions
What are infostealer malware families and how widespread are they?
Infostealers (Redline, Raccoon, Vidar, LummaC2) are commodity malware sold as a service that systematically harvest browser credentials, cookies, and stored passwords. They are extremely prevalent — millions of credential sets stolen by infostealers are available on criminal markets, creating persistent risk from infected non-corporate devices.
Can ManySignal detect infostealer infection directly?
ManySignal detects the behavioural pattern of infostealer execution: processes accessing browser credential databases, bulk file reads in AppData locations, and outbound HTTPS connections to C2 infrastructure. Specific infostealer families have known C2 IP/domain signatures that threat intel feeds flag.
How does browser credential theft relate to session hijacking?
Browsers store both saved passwords and session cookies. Infostealers harvest both. Stolen passwords are used for T1555 credential attacks; stolen cookies are used for T1539 (Steal Web Session Cookie) attacks that bypass MFA entirely.
Is this relevant for organisations using enterprise password managers?
Yes. Enterprise password manager vaults are targeted if an attacker gains a compromised session (stolen access token or authenticated browser session). ManySignal's 1Password and LastPass integration detects bulk vault access anomalies.
What is the macOS Keychain and why is it targeted?
The macOS Keychain stores passwords, certificates, and cryptographic keys for system and application use. It is unlocked when the user logs in. Malware running in the user context can access Keychain items without additional authentication in some configurations.
Does this cover enterprise SSO password stores?
Enterprise IdP (Okta, Entra ID) credential stores are not locally accessible in the same way as browser stores. However, the single password protecting SSO access is extremely high-value — its theft grants access to all SSO-integrated applications. ManySignal monitors IdP authentication anomalies that may indicate SSO credential theft.
What response is recommended when T1555 is detected?
1) Isolate the endpoint. 2) Trigger a credential reset for the affected user across all systems. 3) Revoke all active sessions via IdP. 4) Assess what was accessible from the compromised password stores. 5) Check for lateral movement using harvested credentials in the subsequent hours.
Can ManySignal correlate credential harvesting with subsequent account compromise?
Yes. When T1555 credential harvesting is detected on endpoint A, ManySignal watches for subsequent authentication events using the victim's credentials from new IPs or devices — connecting the theft event to the exploitation event in the investigation timeline.
Does ManySignal detect LastPass breach-related risks?
Following the 2022 LastPass breach, ManySignal monitors for anomalous authentication patterns that may indicate use of credentials from the exposed vault — including logins from new devices, impossible travel, and authentication from Tor/VPN IPs.
How should organisations handle an employee whose personal device was infected with an infostealer?
Treat it as a full credential compromise event: rotate all passwords the employee may have stored on the personal device, revoke all active sessions, reset MFA factors, and conduct a 30-day review of their account activity for signs of prior unauthorised access.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.