Windows Credential Manager Access via VaultCmd

 1title: Windows Credential Manager Access via VaultCmd
 2id: 58f50261-c53b-4c88-bd12-1d71f12eda4c
 3status: test
 4description: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.004/T1555.004.md#atomic-test-1---access-saved-credentials-via-vaultcmd
 7author: frack113
 8date: 2022-04-08
 9modified: 2022-05-13
10tags:
11    - attack.credential-access
12    - attack.t1555.004
13logsource:
14    category: process_creation
15    product: windows
16detection:
17    selection_img:
18        - Image|endswith: '\VaultCmd.exe'
19        - OriginalFileName: 'VAULTCMD.EXE'
20    selection_cli:
21        CommandLine|contains: '/listcreds:'
22    condition: all of selection*
23falsepositives:
24    - Unknown
25level: medium