T1555.004sub-technique of T1555 Credentials from Password Stores

Windows Credential Manager

Windowsnothing on this site yetT1555.004 on attack.mitre.org

Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults). The Windows Credential Manager separates website credentials from application or network credentials in two lockers.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detect Suspicious Access to Windows Credential Manager

Detects unauthorized access to Windows Credential Manager through anomalous process execution (vaultcmd.exe, rundll32.exe keymgr.dll), suspicious API calls (CredEnumerateA), or direct file access to Credential Locker files.

what reduces it

M1042 Disable or Remove Feature or Program. Consider enabling the “Network access: Do not allow storage of passwords and credentials for network authentication” setting that will prevent network credentials from being stored by the Credential Manager.

the rest of T1555

T1555.001 Keychain · not covered yet
T1555.002 Securityd Memory · not covered yet
T1555.003 Credentials from Web Browsers · not covered yet
T1555.005 Password Managers · not covered yet
T1555.006 Cloud Secrets Management Stores · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.