Credentials from Password Stores

ID: T1555
Tactics: TA0006 Credential Access
Platforms: IaaS, Linux, macOS, Windows
Data sources: Process Access, File Access, Process Creation, Cloud Service Enumeration, OS API Execution
Source: attack.mitre.org
MITRE last modified: 12 May 2026

Adversaries may search for common password storage locations to obtain user credentials.^[1] Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Sub-techniques (6)

Detection

DET0430 Detect Credentials Access from Password Stores
Data components: Process Access, File Access, Process Creation, Cloud Service Enumeration, OS API Execution

Mitigations (3)

M1026 Privileged Account Management

Limit the number of accounts and services with permission to query information from password stores to only those required. Ensure that accounts and services with permissions to query password stores only have access to the secrets they require.

M1027 Password Policies

The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password.

Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in improper locations.

M1051 Update Software

Perform regular software updates to mitigate exploitation risk.

Groups (13)

Software (26)

References

F-Secure The Dukes