Detections
Analytics
Credentials from Password Stores: Windows Credential Manager
Description
Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).
Products, Sensors, and Dependencies
| Product | Dependencies | Data source | Access required | Protocol | Data Collected | Notes |
|---|---|---|---|---|---|---|
| Tenable Vulnerability Management | Advanced Network Scan | Windows machines | Authenticated Scan | SMB | Scheduled Task | Plugin ID: 70625 |
References
Attack Path Technique Details
Framework: MITRE ATT&CK
Family: Credential Access
Technique: Credentials from Password Stores
Sub-Technique: Windows Credential Manager
Platform: Windows
Products Required: Tenable Vulnerability Management
Tenable Release Date: 2023 Q3