List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe

Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)

Detects suspicious processes based on name and location that access the Windows Credential History File. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Detects suspicious processes based on name and location that access the Windows Data Protection API Master keys. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function