T1555Credential Access
Credentials from Password Stores
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once…
CVEs10
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.10
Reports1
Detections
8 Sigma rules tagged T1555Credentials from Password StoresT15558 general rules
- HackTool - SecurityXploded Executioncriticalstable
- DPAPI Backup Keys And Certificate Export Activity IOChightest
- HackTool - WinPwn Executionhightest
- HackTool - WinPwn Execution - ScriptBlockhightest
- Suspicious Serv-U Process Patternhightest
- Dump Credentials from Windows Credential Manager With PowerShellmediumtest
- Enumerate Credentials from Windows Credential Manager With PowerShellmediumtest
- PUA - AWS TruffleHog Executionmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Credentials from Password Stores
10 CVEs, by priority. Each link shows its badge.- CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication Bypass VulnerabilityIvanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing ApplicationT1078Valid Accounts+2 more · 4 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%87.7priority
- CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityFortinet · FortiOS and FortiProxyKEVRansomwarePublic exploitCritical · 9.8T1078Valid AccountsT1068Exploitation for Privilege Escalation+2 more · 1 reportMITRE CTID mapping of the KEV entry · primary impact94.3%Top 0.15%83.7priority
- CVE-2025-5777Citrix NetScaler ADC and Gateway Out-of-Bounds Read VulnerabilityCitrix · NetScaler ADC and GatewayKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1555Credentials from Password Stores1 reportMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.02%82.1priority
- CVE-2023-27532Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityVeeam · Backup & ReplicationKEVRansomwarePublic exploitHigh · 7.5T1133External Remote ServicesT1059.003Windows Command Shell+4 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity80.6%Top 0.38%82.0priority
- CVE-2024-21893Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) VulnerabilityIvanti · Connect Secure, Policy Secure, and NeuronsKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing ApplicationT1078Valid Accounts+2 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%78.7priority
- CVE-2019-6693Fortinet FortiOS Use of Hard-Coded Credentials VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitMedium · 6.5T1552Unsecured CredentialsT1555Credentials from Password StoresAI mapping from the description · primary impact6.6%Top 6.1%76.3priority
- CVE-2017-12637SAP NetWeaver Directory Traversal VulnerabilitySAP · NetWeaverKEVPublic exploitHigh · 7.5T1592Gather Victim Host InformationT1190Exploit Public-Facing Application+2 moreMITRE CTID mapping of the KEV entry · follow-on activity95.1%Top 0.14%68.2priority
- CVE-2025-24054Microsoft Windows NTLM Hash Disclosure Spoofing VulnerabilityMITRE CTID mapping of the KEV entry · primary impact62.3%Top 0.82%66.6priority
- CVE-2025-48927TeleMessage TM SGNL Initialization of a Resource with an Insecure Default VulnerabilityTeleMessage · TM SGNLKEVMedium · 5.3T1212Exploitation for Credential AccessT1555Credentials from Password Stores+1 moreMITRE CTID mapping of the KEV entry · primary impact11.6%Top 4%60.9priority
- CVE-2025-48928TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityTeleMessage · TM SGNLKEVMedium · 4.0T1212Exploitation for Credential AccessT1555Credentials from Password Stores+1 moreMITRE CTID mapping of the KEV entry · primary impact0.6%Top 52%50.3priority