TA0006 · CREDENTIAL ACCESS
Windows Credential Manager
Adversaries may acquire credentials from the Windows Credential Manager.
Detect it with
Monitor process and command-line parameters of vaultcmd.exe for suspicious activity, such as listing credentials from the Windows Credentials locker (i.e., vaultcmd /listcreds:“Windows Credentials” ).
Why it matters on shift
Windows Credential Manager is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context