Credentials from Password Stores
Password-store access targets credentials retained by operating systems or applications.
What it means
Password-store access targets credentials retained by operating systems or applications. The available material depends on store protection and the compromised execution context.
MITRE ATT&CK catalogs this behavior as T1555, within credential access. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
An unknown process reads a credential store following access to the user's profile.
Evidence to examine
Review store access, process privileges, user context, protection mechanisms, and later authentication activity.
A common analytical pitfall
Accessing a store file is not proof that its protected credentials were decrypted successfully.
Response considerations
Preserve evidence and assess realistic credential exposure, then protect affected identities and investigate the initial endpoint access.
Storage protection depends on the surrounding system
A fictional endpoint stores application credentials through a supported password manager. Malware running with sufficient access may try to obtain stored credentials or use an unlocked application context. The relevant question is not merely whether the password database is encrypted, but which processes and users can reach the decryption capability.
Different stores have different designs and lifecycle behavior. Browser credentials, operating-system stores, and dedicated password managers should not be treated as identical files with identical protections. Review official platform guidance and the actual access conditions before describing what an attacker could recover.
Evidence of a process touching a store is not always proof of theft. Legitimate applications may access their own credentials. Correlate process identity, user context, timing, subsequent account use, and other endpoint evidence. Protect collected artifacts because they may contain sensitive credential material.
Reason about an unlocked endpoint
For a paper exercise, draw a user, a credential store, and two applications with different permissions. Explain which application should be allowed to request which credential and how a compromised user session changes the threat. Use dummy secrets only if demonstrating a supported store in an isolated lab.
If exposure is confirmed, response should consider credential rotation, session revocation, and the endpoint condition. Changing a password while the device remains compromised may expose the replacement. Scope the response to the stores and accounts actually affected rather than assuming every credential was recovered. This technique connects endpoint trust, secret storage, and account control, showing why a secure storage mechanism still needs a protected execution environment and a practical recovery plan.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1555: Credentials from Password Stores