Windows Credential Manager Access via VaultCmd
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
Sigma rule (View on GitHub)
1title: Windows Credential Manager Access via VaultCmd
2id: 58f50261-c53b-4c88-bd12-1d71f12eda4c
3status: test
4description: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
5references:
6 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.004/T1555.004.md#atomic-test-1---access-saved-credentials-via-vaultcmd
7author: frack113
8date: 2022/04/08
9modified: 2022/05/13
10tags:
11 - attack.credential_access
12 - attack.t1555.004
13logsource:
14 category: process_creation
15 product: windows
16detection:
17 selection_img:
18 - Image|endswith: '\VaultCmd.exe'
19 - OriginalFileName: 'VAULTCMD.EXE'
20 selection_cli:
21 CommandLine|contains: '/listcreds:'
22 condition: all of selection*
23falsepositives:
24 - Unknown
25level: medium
References
Related rules
- Added Owner To Application
- App Granted Microsoft Permissions
- Application AppID Uri Configuration Changes
- Application URI Configuration Changes
- Audit CVE Event