Searching for Saved Credentials via VaultCmd
Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2021/01/19"
3integration = ["endpoint", "windows"]
4maturity = "production"
5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6min_stack_version = "8.3.0"
7updated_date = "2024/03/28"
8
9[rule]
10author = ["Elastic"]
11description = """
12Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected
13applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for
14saved usernames and passwords. This may also be performed in preparation of lateral movement.
15"""
16from = "now-9m"
17index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
18language = "eql"
19license = "Elastic License v2"
20name = "Searching for Saved Credentials via VaultCmd"
21references = [
22 "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16",
23 "https://web.archive.org/web/20201004080456/https://rastamouse.me/blog/rdp-jump-boxes/",
24 "https://www.elastic.co/security-labs/detect-credential-access",
25]
26risk_score = 47
27rule_id = "be8afaed-4bcd-4e0a-b5f9-5562003dde81"
28setup = """## Setup
29
30If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
31events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
32Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
33`event.ingested` to @timestamp.
34For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
35"""
36severity = "medium"
37tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
38timestamp_override = "event.ingested"
39type = "eql"
40
41query = '''
42process where host.os.type == "windows" and event.type == "start" and
43 (?process.pe.original_file_name:"vaultcmd.exe" or process.name:"vaultcmd.exe") and
44 process.args:"/list*"
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1003"
52name = "OS Credential Dumping"
53reference = "https://attack.mitre.org/techniques/T1003/"
54
55[[rule.threat.technique]]
56id = "T1555"
57name = "Credentials from Password Stores"
58reference = "https://attack.mitre.org/techniques/T1555/"
59[[rule.threat.technique.subtechnique]]
60id = "T1555.004"
61name = "Windows Credential Manager"
62reference = "https://attack.mitre.org/techniques/T1555/004/"
63
64
65
66[rule.threat.tactic]
67id = "TA0006"
68name = "Credential Access"
69reference = "https://attack.mitre.org/tactics/TA0006/"
References
Related rules
- Command Shell Activity Started via RunDLL32
- Creation or Modification of Domain Backup DPAPI private key
- Credential Acquisition via Registry Hive Dumping
- Full User-Mode Dumps Enabled System-Wide
- LSASS Memory Dump Creation