T1555 Credentials from Password Stores
EnterpriseAdversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (6)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Isolate
Deceive
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- DE.CMContinuous Monitoringmoderate · backed by 3 of 8 mapped controls
- ID.IMImprovementmoderate · backed by 3 of 8 mapped controls
- ID.RARisk Assessmentmoderate · backed by 3 of 8 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (8)
Security controls that mitigate this.
known-exploited CVEs (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-5777US | high7.5OT critical | KEV | ||
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server | ||||
| CVE-2025-48928US | —OT critical | KEV | ||
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over H… | ||||
| CVE-2025-48927US | —OT critical | KEV | ||
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025. | ||||
| CVE-2025-24054US | medium5.4OT critical | KEV | ||
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2024-55591US | critical9.8OT critical | KEV | ||
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7… | ||||
| CVE-2024-21893US | high8.2OT critical | KEV | ||
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an att… | ||||
| CVE-2023-46805US | high8.2OT critical | KEV | ||
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing co… | ||||
| CVE-2023-27532US | high7.5OT critical | KEV | ||
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backu… | ||||
| CVE-2017-12637US | high7.5OT critical | KEV | ||
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary file… | ||||
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (13)
Threat groups associated with this.
software (26)
Malware and tools associated with this.
campaigns (3)
Campaigns that use this.
Detected by (Sigma) (8)
Sigma detection rules related to this.
source
Where this definition is published.