Detection rules › Sigma
Vault credentials manager accessed
Detects scenarios where an attacker attempts to access vault credentials
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1555.004 Credentials from Password Stores: Windows Credential Manager |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 5382 | Vault credentials were read. |
Rule body yaml
title: Vault credentials manager accessed
description: Detects scenarios where an attacker attempts to access vault credentials
correlation: correlate ClientProcessId with Process PID from event ID 4688 to identify the origin of the access.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1555.004-Windows%20Credential%20Manager
- https://twitter.com/SBousseaden/status/1573380065714470912
- https://sites.utexas.edu/glenmark/2019/10/21/using-passwordvault-with-powershell/
- https://twitter.com/SBousseaden/status/1573380065714470912
- https://gist.github.com/Samirbous/c3c4122493ea5076adea9c895d2340ea
tags:
- attack.credential_access
- attack.t1555.004
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 5382
selection_resource:
Resource|startswith: 'http'
selection_identity:
Identity|contains: '@'
condition: selection and (selection_resource or selection_identity)
falsepositives:
- software accessing the Windows Web Password Credential
level: medium
Stages and Predicates
Stage 0: condition
selection and (selection_resource or selection_identity)Stage 1: selection
selection:
EventID: 5382
Stage 2: selection_resource
selection_resource:
Resource|startswith: 'http'
Stage 3: selection_identity
selection_identity:
Identity|contains: '@'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.