Password Managers
Subtechnique · ATTACK:enterprise:T1555.005
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1555.005",
"title": "Password Managers",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1555/005",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--315f51f0-6b03-4c1e-bfb2-84740afb8e21",
"external_id": "T1555.005",
"domain": "enterprise",
"created": "2021-01-22T16:08:40.629Z",
"modified": "2025-10-24T17:48:36.347Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"credential-access"
],
"source_references": [
{
"source_name": "Cyberreason Anchor December 2019",
"url": "https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"
},
{
"source_name": "FoxIT Wocao December 2019",
"url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
},
{
"source_name": "ise Password Manager February 2019",
"url": "https://www.ise.io/casestudies/password-manager-hacking/"
},
{
"source_name": "Github KeeThief",
"url": "https://github.com/GhostPack/KeeThief"
},
{
"source_name": "NVD CVE-2019-3610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3610"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13e7416a-7a02-438f-a708-598f132ea394
FoxIT Wocao December 2019ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2488fee3-78ad-4ea6-b111-2d0c372b36d2
ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c036695-32e2-458f-a0f1-25cd2e8b9fbd
Trend Micro DRBControl February 2020ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c254f88-f567-43d8-9384-54edcf0cb348
Mandiant_UNC2165ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70fe7f39-41de-4d7d-b691-4ac17c1a4c58
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ed11b3a-c4c1-4c31-8614-d34a37d8a779
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92cfd4ff-3a37-485a-a0bf-4ee3996da44b
ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95e80511-d9ec-4001-8f49-37bc4ed71379
Kaspersky Ferocious Kitten Jun 2021ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--971e0f50-01f7-4403-b99e-94ed4cf65269
Hunt.io TeamPCP Toolkit MAY 2026 · Wiz Mini Shai-Hulud MAY 2026 · Phoenix TeamPCP 20 MAY 2026ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c3b5b84-655b-452e-93f1-d0fbbd91baaa
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a228727a-69ef-4cf6-aa2a-808e0116249c
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a95c8f0a-a7ba-4af0-b3ac-5abaf44ff563
objsee mac malware 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc016a10-a594-495b-8822-ca054050f144
Cyberreason Anchor December 2019ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc2f4b77-5b2f-4942-a6c0-9c2a19e1f7b0
ATTACK:enterprise:T1555.005 → subtechnique-of → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1651c82-8b4e-4aef-b065-732cf12e7b79
ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d474431a-8b2b-4e17-9cbf-e0b28eb00d1a
Mandiant VMware vSphere JUL 2025 · Mandiant UNC3944 May 2025ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4bc428b-028f-4f9a-b95b-3721e6df97eb
ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de075e77-f83e-4156-a40f-e7e475e15469
NCC Group LAPSUS Apr 2022ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f569160b-af34-4919-8cfc-0dce1762e87d
NIST 800-63-3