Windows Credential Manager
Subtechnique · ATTACK:enterprise:T1555.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1555.004",
"title": "Windows Credential Manager",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1555/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--d336b553-5da9-46ca-98a8-0b23f49fb447",
"external_id": "T1555.004",
"domain": "enterprise",
"created": "2020-11-23T15:35:53.793Z",
"modified": "2025-10-24T17:49:26.444Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"credential-access"
],
"source_references": [
{
"source_name": "Malwarebytes The Windows Vault",
"url": "https://blog.malwarebytes.com/101/2016/01/the-windows-vaults/"
},
{
"source_name": "Delpy Mimikatz Crendential Manager",
"url": "https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials"
},
{
"source_name": "Microsoft Credential Locker",
"url": "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/jj554668(v=ws.11)?redirectedfrom=MSDN"
},
{
"source_name": "Microsoft Credential Manager store",
"url": "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh994565(v=ws.11)#credential-manager-store"
},
{
"source_name": "Microsoft CredEnumerate",
"url": "https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credenumeratea"
},
{
"source_name": "passcape Windows Vault",
"url": "https://www.passcape.com/windows_password_recovery_vault_explorer"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--024593ae-03a1-4ffa-a5fc-fc2fe43e6ebf
FireEye APT34 July 2019ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04a6eba6-71d7-47d1-91f1-c728ada6b7b5
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13c82683-dea9-418b-9112-a801c4cebc64
SentinelOne Valak June 2020ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2188382d-d557-4a81-9713-7ef4cc675e76
Symantec Waterbug Jun 2019ATTACK:enterprise:S0349 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--250af0e7-a45e-4cbe-9cad-5445e8669022
GitHub LaZagne Dec 2018ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d925633-c463-4ca8-afb7-888505c70633
BiZone Lizar May 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f3b9887-80cb-4b36-b228-91e360d83962
Talos Group123ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--841330d7-96f7-453a-9a91-9dd2c6e1cfc4
Microsoft Network access Credential ManagerATTACK:enterprise:T1555.004 → subtechnique-of → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d2c3989-1b2f-4620-9315-3ef02c781679
ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae8375ef-1dd7-4b03-9fc9-ade303030cae
Bitdefender Naikon April 2021ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc0367d2-ad95-4197-b3b4-432e8bba6fec
GitHub SILENTTRINITY Modules July 2019ATTACK:enterprise:C0044 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0f25bc5-098d-4ef8-ad8f-e79d7fa0fe7d
ESET OilRig Campaigns Sep 2023ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c92047b8-50d6-4fde-8acd-98132dcdc32f
Delpy Mimikatz Crendential ManagerATTACK:enterprise:S0526 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d041fce9-6e05-4f74-a97e-c71f1b270fb8
Cybereason Kimsuky November 2020ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da4e4583-7382-4a38-a922-9b5f6c61b8a7
GitHub PowerSploit May 2012 · PowerSploit DocumentationATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8e8e281-398c-4cec-bcc5-d12d28bada31
Mandiant FIN12 Oct 2021