Stored credentials exported using credwiz.exe

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores (T1555)
Severity	Low

Description

Attackers may abuse the credwiz tool to export stored accounts.

Attacker's Goals

An attacker may attempt to gain higher privileges.

Investigative actions

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Variations

Stored credentials exported using credwiz.exe using keymgr.dll's KRShowKeyMgr function

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores (T1555)
Severity	Medium

Description

Attackers may abuse the credwiz tool to export stored accounts using keymgr.dll's KRShowKeyMgr function.

Attacker's Goals

An attacker may attempt to gain higher privileges.

Investigative actions

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Stored credentials exported using credwiz.exe over RDP

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006), Lateral Movement (TA0008)
ATT&CK Technique	Credentials from Password Stores (T1555), Remote Services: Remote Desktop Protocol (T1021.001)
Severity	Low

Description

Attackers may abuse the credwiz tool to export stored accounts over RDP.

Attacker's Goals

An attacker may attempt to gain higher privileges.

Investigative actions

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Stored credentials exported using credwiz.exe with a built-in Windows tool

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores (T1555)
Severity	Low

Description

Attackers may abuse the credwiz tool to export stored accounts with a built-in Windows tool.

Attacker's Goals

An attacker may attempt to gain higher privileges.

Investigative actions

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.