T1555.005 — Password Managers

Tactic: Credential Access · Platforms: Linux, macOS, Windows

Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the…

Sub-technique of Credentials from Password Stores (T1555).

Sigma detection rules (3)

T1555.005 Credentials from Password Stores: Password Managers

title: "T1555.005 Credentials from Password Stores: Password Managers"
id: 865b593e-f042-43ff-8a88-d11a07e97989
description: 'Detect Unauthorized Access to Password Managers. (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: PasswordManagerBinaries, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1555/005
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.005

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '10'
    TargetImage|endswith:
      - '\KeePass.exe'
      - '\KeePassXC.exe'
      - '\1Password.exe'
      - '\LastPass.exe'
      - '\Dashlane.exe'
      - '\Bitwarden.exe'
      - '\RoboForm.exe'
    GrantedAccess:
      - '0x1010'
      - '0x1038'
      - '0x1400'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1fffff'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Endpoint security or backup agents legitimately opening high-access handles to password-manager processes. System and service accounts are excluded via filter_system_account, tune further with process/path allowlists if noise remains.

level: medium

T1555.005 Credentials from Password Stores: Password Managers

title: "T1555.005 Credentials from Password Stores: Password Managers"
id: e26f7540-f749-41d2-9a89-3254fbc22ddd
description: 'Detect Unauthorized Access to Password Managers. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VaultFilePaths, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1555/005
author: Shahrukh Khan
date: 2026-02-02
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.005

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    name|endswith:
      - '.kdbx'
      - '.vault-token'
      - '/1password/data.sqlite'

  condition: selection

falsepositives:
  - Normal user access to their own KeePass database or the local Vault CLI token cache; auditd PATH records don't distinguish read-only opens from exfiltration-oriented copies, so a time-window/volume baseline (as tuned) is required to reduce noise.

level: medium

T1555.005 Credentials from Password Stores: Password Managers

title: "T1555.005 Credentials from Password Stores: Password Managers"
id: 8d0306b4-6dd1-4946-846b-b858e6dd5cfc
description: 'Detect Unauthorized Access to Password Managers. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VaultFileExtensions, ParentProcessWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1555/005
author: Shahrukh Khan
date: 2026-02-26
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.005

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/sqlite3'
      - '/cat'
      - '/python3'
    CommandLine|contains:
      - '.kdbx'
      - '.opvault'
      - '.1password'

  condition: selection

falsepositives:
  - Backup or sync utilities reading password manager vault files as part of scheduled cloud backup.

level: high

Related sub-techniques

Explore