Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement.
Rule type: eql
Risk score: 47
Runs every: 5 minutes
Maximum alerts per execution: 100
- Threat Detection
- Credential Access
Added (Elastic Stack release): 7.12.0
Rule authors: Elastic
Rule license: Elastic License v2
process where event.type in ("start", "process_started") and (process.pe.original_file_name:"vaultcmd.exe" or process.name:"vaultcmd.exe") and process.args:"/list*"