Skip to content

Credentials from Password Stores

Technique · ATTACK:enterprise:T1555

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1555",
  "title": "Credentials from Password Stores",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1555",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3fc9b85a-2862-4363-a64d-d692e3ffbee0",
  "external_id": "T1555",
  "domain": "enterprise",
  "created": "2020-02-11T18:48:28.456Z",
  "modified": "2026-05-12T15:12:00.628Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "F-Secure The Dukes",
      "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
    }
  ]
}

Explicit source assertions (51)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0545e60c-080c-4930-a729-b3ce7dc51979

Kaspersky Lyceum October 2021

ATTACK:enterprise:S9022 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--065810ad-cd56-401a-a19b-94dc302ed8e2

ESET MirrorFace DEC 2022 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a4819da-bba0-487b-abff-41d6fba75922

ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d8d668e-ce2f-4ef8-8dd4-8c9cd17f2b23

Prevx Carberp March 2011

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11d0f089-6dc7-4468-b186-e1a8b621051b

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--138ce3f0-c306-4fc7-a633-7861fedf51e9

Netskope XLoader 2022 · Google XLoader 2017

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f888716-1e49-4d8d-b693-67c6eae8a775

Infoblox Lokibot January 2019

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20ed819f-4312-48ea-bb52-357243ab192a

ESET EvasivePanda 2023 · Symantec Daggerfly 2023

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--231b6e9d-314e-41af-a1aa-7f527f4c3351

Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · FBI TeamPCP JUL 2026

ATTACK:enterprise:S1156 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2608b224-fb63-4bc6-aa21-ce0537b31861

Talos Manjusaka 2022

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--297bf9d5-0644-4434-b1d6-cac1568188cc

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29f40ca0-8255-44f3-afea-8facfd150314

Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d116ef6-d11b-4d04-9bf8-c51def11bd3b

Symantec Leafminer July 2018

ATTACK:enterprise:S0167 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47a95ac1-e37a-40ea-bf1e-e99ff4483998

ClearSky Wilted Tulip July 2017 · CopyKittens Nov 2015

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48103193-5bea-4e7f-8e56-aead3fca63f9

AI-Mexico-Govt-Breach

ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d3e4232-1330-45a9-9e90-9914eed276a5

Citizen Lab Stealth Falcon May 2016

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d7add6f-ebd5-477f-9958-a5176835da2e

F-Secure The Dukes

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5abc3844-d260-4928-82a2-eca9cf5115f6

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c84cfe2-a395-47c6-831a-4491f8585a00

ESET Operation Groundbait

ATTACK:enterprise:S0435 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dd0d491-bb82-45b4-91cd-a7d9e4cf396e

ESET PLEAD Malware July 2018

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b2af30a-523f-41fe-88c3-ab2ee15bdec5

BitDefender Chafer May 2020

ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b914660-657e-4f6e-a9be-ed51c840875e

ESET EvilNum July 2020

ATTACK:enterprise:T1555.004 → subtechnique-of → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d2c3989-1b2f-4620-9315-3ef02c781679

ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--941fe970-2c7c-4c61-9125-b59b3ec9eb90

ESET Contagious Interview BeaverTail InvisibleFerret February 2025

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97bf812b-0bc4-4bfa-9a03-872cacffd272

Trellix Darkgate 2023

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99ef9825-e901-49fc-8d87-668ff60b52dc

Red Canary NETWIRE January 2020

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9bbd3f33-593a-4ce8-b88f-9f9b6fca9aff

Rostovcev APT41 2021

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c555aa7-87fa-4c5d-9224-a61cd0d0157f

Symantec Elfin Mar 2019 · FireEye APT33 Guardrail

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9dfb0ad2-5456-492a-bb74-a288ce8f7f7c

Unit 42 MuddyWater Nov 2017 · Symantec MuddyWater Dec 2018 · Trend Micro Muddy Water March 2021

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f0f23ed-644d-44f5-bee9-c3f44f04a6d8

GitHub QuasarRAT · Volexity Patchwork June 2018

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fba03e7-126f-42ca-81a4-5c314756a36a

Kroll RedLine Stealer August 2024 · Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abe93e80-2fc7-4c71-846e-b476529b4ae6

Cybereason Astaroth Feb 2019

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae151f0a-374b-47c0-a4e6-b9bdc7ee55b5

Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:S0349 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0f355cc-e11f-4027-9db3-59ec64cd367f

GitHub LaZagne Dec 2018

ATTACK:enterprise:S0138 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c002d944-83b6-4b64-a7a7-3129f31f9ae2

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c19fcf1c-8c2c-4a71-a1fb-43934cc6ba23

ATTACK:enterprise:S0048 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c23fa4f7-84a0-424a-b8b1-b3024d01e749

F-Secure The Dukes

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c27b0834-d1b8-440f-9b35-e15e78ecd715

FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · FireEye APT35 2018 · Unit42 OilRig Playbook 2023

ATTACK:enterprise:T1555.001 → subtechnique-of → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9a1bcec-9a4d-4693-accb-5a6f67b857f6

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfd0e8ac-6aa6-4998-a21a-e68ea8479147

Microsoft CYBERWARCON NOV 2024 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:T1555.005 → subtechnique-of → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1651c82-8b4e-4aef-b065-732cf12e7b79

ATTACK:enterprise:T1555.006 → subtechnique-of → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1deffba-9885-4b52-b2b5-cbfcec82a52b

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2212e02-787a-4893-8ecd-d1ac6619bf9f

Visa FIN6 Feb 2019

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d398f48c-9d01-4f6e-bb19-3ebae25cb71c

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:G1026 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4c0fc27-4234-43bb-9f11-eb018e21c359

SCILabs Malteiro 2021

ATTACK:enterprise:T1555.003 → subtechnique-of → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e92c4fd7-eb92-4255-80c3-abaa9262845f

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9cbcdd4-645d-45ee-a5b6-65c651afe154

ESET Security Mispadu Facebook Ads 2019 · Segurança Informática URSA Sophisticated Loader 2020 · SCILabs Malteiro 2021

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb46f5b9-ff45-4229-b24a-7344829f0884

ATTACK:enterprise:T1555.002 → subtechnique-of → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee14c1f8-55f5-4fcf-adc3-dc34d6ade005

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f461e96f-1d76-4a40-ad84-8f7f7c3cc202

SecureWorks August 2019

ATTACK:enterprise:S0526 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f48ee432-cc6e-4f34-a8bf-0338c1d796d6

Cybereason Kimsuky November 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.