T1555.004 — Windows Credential Manager

Tactic: Credential Access · Platforms: Windows

Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults). The Windows…

Sub-technique of Credentials from Password Stores (T1555).

Sigma detection rules (1)

T1555.004 Credentials from Password Stores: Windows Credential Manager

title: "T1555.004 Credentials from Password Stores: Windows Credential Manager"
id: c8b5be31-154e-41b8-ac35-b615e8b6d943
description: 'Detects use of vaultcmd.exe, rundll32.exe with keymgr.dll, or PowerShell CredentialManager module to enumerate/extract Windows Credential Manager vault credentials. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: MonitoredPaths, TimeWindow, PrivilegedUsers.'
references:
  - https://attack.mitre.org/techniques/T1555/004
author: Shahrukh Khan
date: 2026-03-06
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.004

logsource:
  category: process_creation
  product: windows

detection:
  selection_vaultcmd:
    Image|endswith: '\vaultcmd.exe'
  selection_keymgr:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains: 'keymgr.dll'
  selection_ps_credmgr:
    CommandLine|contains: 'Get-StoredCredential'
  condition: 1 of selection_*

falsepositives:
  - Legitimate admin use of vaultcmd.exe or Credential Manager UI.

level: medium

Related sub-techniques

Explore