PowerShell Enumerates Stored Windows Credential Manager Entries via vaultcmd /listcreds

title: PowerShell Enumerates Stored Windows Credential Manager Entries via vaultcmd /listcreds
id: 63421c5a-143a-47f3-b5e8-3be94024825a
status: test
description: This rule identifies PowerShell script block content that calls vaultcmd with /listcreds to enumerate credential entries. It further narrows matches to cases where the output includes “Windows Credentials” and/or “Web Credentials”, indicating the credential manager stores that data. Enumerating credential manager contents helps attackers discover potential credentials for later access, relying on PowerShell Script Block Logging telemetry.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_enumerate_password_windows_credential_manager.yml
author: frack113, Huntrule Team
date: 2021-12-20
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1555
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmd:
    ScriptBlockText|contains|all:
      - vaultcmd
      - "/listcreds:"
  selection_option:
    ScriptBlockText|contains:
      - Windows Credentials
      - Web Credentials
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 603c6630-5225-49c1-8047-26c964553e0e
    type: derived