Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Credentials from Password Stores

Sub-techniques (6)

ID	Name
.001	Keychain
.002	Securityd Memory
.003	Credentials from Web Browsers
.004	Windows Credential Manager
.005	Password Managers
.006	Cloud Secrets Management Stores

Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

ID: T1555

Sub-techniques: .001 .002 .003 .004 .005 .006

Tactic(s): Credential Access

Platforms: IaaS, Linux, macOS, Windows

Data Sources: Cloud Service: Cloud Service Enumeration, Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Access, Process: Process Creation

Version: 1.2

Created: 11 Feb 2020

Last Modified: 15 Oct 2024

Name	Description
Procedure Examples
HEXANE	HEXANE has run `cmdkey` on victim machines to identify stored credentials.(Citation: Kaspersky Lyceum October 2021)
Carberp	Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.(Citation: Prevx Carberp March 2011)
Mimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.(Citation: Deply Mimikatz)(Citation: GitHub Mimikatz lsadump Module)(Citation: Directory Services Internals DPAPI Backup Keys Oct 2015)(Citation: NCSC Joint Report Public Tools)(Citation: Cobalt Strike Manual 4.3 November 2020)
Lokibot	Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.(Citation: Infoblox Lokibot January 2019)
MgBot	MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software.(Citation: ESET EvasivePanda 2023)(Citation: Symantec Daggerfly 2023)
Manjusaka	Manjusaka extracts credentials from the Windows Registry associated with Premiumsoft Navicat, a utility used to facilitate access to various database types.(Citation: Talos Manjusaka 2022)
Volt Typhoon	Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)
APT29	APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.(Citation: Microsoft Deep Dive Solorigate January 2021)
Leafminer	Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)
Matryoshka	Matryoshka is capable of stealing Outlook passwords.(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2015)
Stealth Falcon	Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.(Citation: Citizen Lab Stealth Falcon May 2016)
CosmicDuke	CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.(Citation: F-Secure The Dukes)
Prikormka	A module in Prikormka collects passwords stored in applications installed on the victim.(Citation: ESET Operation Groundbait)
PLEAD	PLEAD has the ability to steal saved passwords from Microsoft Outlook.(Citation: ESET PLEAD Malware July 2018)
APT39	APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.(Citation: BitDefender Chafer May 2020)
Evilnum	Evilnum can collect email credentials from victims.(Citation: ESET EvilNum July 2020)
UNC2452	UNC2452 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.(Citation: Microsoft Deep Dive Solorigate January 2021)
DarkGate	DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.(Citation: Trellix Darkgate 2023)
NETWIRE	NETWIRE can retrieve passwords from messaging and mail client applications.(Citation: Red Canary NETWIRE January 2020)
APT41	APT41 has obtained information about accounts, lists of employees, and plaintext and hashed passwords from databases.(Citation: Rostovcev APT41 2021)
APT33	APT33 has used a variety of publicly available tools like LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)
MuddyWater	MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)
QuasarRAT	QuasarRAT can obtain passwords from common FTP clients.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018)
Astaroth	Astaroth uses an external software known as NetPass to recover passwords. (Citation: Cybereason Astaroth Feb 2019)
Agent Tesla	Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.(Citation: Malwarebytes Agent Tesla April 2020)
LaZagne	LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.(Citation: GitHub LaZagne Dec 2018)
OLDBAIT	OLDBAIT collects credentials from several email clients.(Citation: FireEye APT28)
PinchDuke	PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.(Citation: F-Secure The Dukes)
OilRig	OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)
FIN6	FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.(Citation: Visa FIN6 Feb 2019)
	During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.(Citation: Microsoft Deep Dive Solorigate January 2021)
Malteiro	Malteiro has obtained credentials from mail clients via NirSoft MailPassView.(Citation: SCILabs Malteiro 2021)
Mispadu	Mispadu has obtained credentials from mail clients via NirSoft MailPassView.(Citation: SCILabs Malteiro 2021)(Citation: Segurança Informática URSA Sophisticated Loader 2020)(Citation: ESET Security Mispadu Facebook Ads 2019)
Pupy	Pupy can use Lazagne for harvesting credentials.(Citation: GitHub Pupy)
PoshC2	PoshC2 can decrypt passwords stored in the RDCMan configuration file.(Citation: SecureWorks August 2019)
KGH_SPY	KGH_SPY can collect credentials from WINSCP.(Citation: Cybereason Kimsuky November 2020)

Mitigation	Description
Mitigations
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
Update Software	Perform regular software updates to mitigate exploitation risk.
Password Policies	Set and enforce secure password policies for accounts.

Detection

Monitor system calls, file read events, and processes for suspicious activity that could indicate searching for a password or other activity related to performing keyword searches (e.g. password, pwd, login, store, secure, credentials, etc.) in process memory for credentials. File read events should be monitored surrounding known password storage applications.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.