TA0006 · CREDENTIAL ACCESS
Credentials from Password Stores
Browser saved passwords, keychains, and password manager databases harvested from disk.
Detect it with
Non-browser processes reading Login Data or logins.json; access to .kdbx and keychain files by new binaries.
Why it matters on shift
Credentials from Password Stores is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
6 sub-techniques
How it shows up in practice
- T1555.001
Keychain
Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.
- T1555.002
Securityd Memory
An adversary with root access may gather credentials by reading securityd’s memory. securityd is a service/daemon responsible for implementing security protocols such as encryption and authorization.
- T1555.003
Credentials from Web Browsers
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
- T1555.004
Windows Credential Manager
Adversaries may acquire credentials from the Windows Credential Manager.
- T1555.005
Password Managers
Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database.
- T1555.006
Cloud Secrets Management Stores
Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.
Kill-chain context