Skip to content

Hide Navigation Hide TOC

Enumerate Credentials from Windows Credential Manager With PowerShell (603c6630-5225-49c1-8047-26c964553e0e)

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Cluster A Galaxy A Cluster B Galaxy B Level
Enumerate Credentials from Windows Credential Manager With PowerShell (603c6630-5225-49c1-8047-26c964553e0e) Sigma-Rules Credentials from Password Stores - T1555 (3fc9b85a-2862-4363-a64d-d692e3ffbee0) Attack Pattern 1