ATT&CK technique
View on MITRE ATT&CK →
T1555.004
Windows Credential Manager
Credential Access
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential Credential Access via Trusted Developer Utility | production | 2026-09-18 |
| elastic | Searching for Saved Credentials via VaultCmd | production | 2026-09-18 |
| elastic | Multiple Vault Web Credentials Read | production | 2026-09-18 |
| elastic | Potential Invoke-Mimikatz PowerShell Script | production | 2026-09-18 |
| sigma | Access To Windows DPAPI Master Keys By Uncommon Applications | test | 2026-07-28 |
| splunk | Windows Credentials Access via VaultCli Module | production | 2026-05-13 |
| sigma | Access To Windows Credential History File By Uncommon Applications | test | 2024-07-29 |
| sigma | Suspicious Key Manager Access | test | 2023-02-09 |
| sigma | Windows Credential Manager Access via VaultCmd | test | 2022-05-13 |