Detecting Windows Credential Manager Theft (T1555.004)

Windows Credential Manager remembers logins so users do not retype them. MITRE ATT&CK technique T1555.004, Windows Credential Manager, covers adversaries pulling credentials from it. The tactic is credential access and the platform is Windows.

How attackers use it

Credential Manager stores credentials for signing in to websites, applications and devices that request authentication through NTLM or Kerberos, in Credential Lockers (previously called Windows Vaults). It keeps two lockers. The Web Credentials locker holds Internet Explorer and Edge website credentials, which ties into the browser technique T1555.003. The Windows Credentials locker holds application and network credentials.

Lockers store credentials in encrypted .vcrd files in the user's AppData\Local\Microsoft folder under a Vault or Credentials directory. The encryption key sits in a file named Policy.vpol, typically in the same folder.

MITRE lists several ways adversaries get at them:

• vaultcmd.exe, a native executable that can enumerate credentials in the locker from the command line.
• Reading the locker files directly.
• Windows APIs such as CredEnumerateA to list stored credentials.
• Credential backups, created by running rundll32.exe keymgr.dll KRShowKeyMgr and choosing "Back up..." in the "Stored User Names and Passwords" window.
• Password recovery tools that can obtain plaintext passwords from Credential Manager.

How to detect it

MITRE lists no data sources here. Useful signals follow from the methods above:

• Process creation for vaultcmd.exe, particularly with list or enumerate style arguments, or run by something other than an administrator troubleshooting.
• rundll32.exe loading keymgr.dll with KRShowKeyMgr outside of a user opening the dialog.
• File access to the Vault and Credentials folders by processes that are not part of Windows.
• Creation of backup files from the credential backup flow.

Process command line logging, through Sysmon event 1 or Windows event 4688, covers the first two with no extra tooling.

How to reduce the risk

MITRE lists one mitigation. Consider enabling the policy "Network access: Do not allow storage of passwords and credentials for network authentication", which prevents network credentials from being stored by Credential Manager. Fewer stored credentials means less to steal.

Back it up with the basics: multi-factor authentication for accounts that can reach sensitive systems, and separate privileged accounts that users never sign in to with a saved password.

Check your own environment

# Windows: list the credential entries visible to the current user (names only)
cmdkey /list

cmdkey /list shows target names and usernames, not passwords. Review it on a few machines for domain admin or service entries that should not be saved. Also confirm the Group Policy setting above is applied where your risk assessment calls for it.

Quick check

Sources

• MITRE ATT&CK T1555.004 Windows Credential Manager