Procedure examples

Mimikatz contains functionality to acquire credentials from the Windows Credential Manager.

LaZagne can obtain credentials from Vault files.

During Operation Wocao, threat actors accessed and collected credentials from password managers.

Indrik Spider has accessed and exported passwords from password managers.

Scattered Spider has searched for credentials in password vaults and Privileged Access Management (PAM) solutions including HashiCorp Vault.

UNC3886 has targeted KeyPass password database files for credential access.

Storm-0501 has stolen credentials contained in the password manager Keepass by utilizing Find-KeePassConfig.ps1.

Fox Kitten has used scripts to access credential information from the KeePass database.

LAPSUS$ has accessed local password managers and databases to obtain further credentials from a compromised network.

Threat Group-3390 obtained a KeePass database from a compromised host.

TrickBot can steal passwords from the KeePass open source password manager.

InvisibleFerret has utilized the command `ssh_zcp` to exfiltrate data from browser extensions and password managers via Telegram and FTP.

MarkiRAT can gather information from the Keepass password manager.

Proton gathers credentials in files for 1password.

Mini Shai-Hulud has gathered credentials stored in password managers to include password vaults.

HAFNIUM has moved laterally from on-premises environments to steal passwords from Azure key vaults.

Storm-0501 has utilized Azure Key Vault to store the encryption key using the operation `Microsoft.KeyVault/Vaults/write`.

Shai-Hulud has gathered secrets from AWS Secrets and GCP Secret Manager. Shai-Hulud has also gathered data from Azure Key Vault.

Pacu can retrieve secrets from the AWS Secrets Manager via the enum_secrets module.

TruffleHog can obtain secrets from AWS Secrets and GCP Secret Manager. TruffleHog has also gathered passwords, secrets and API keys from source repositories, .env files, and git history.

TeamPCP Cloud Stealer can enumerate multiple filesystem paths to extract credentials for AWS, GCP, and Azure including Identity Access Management (IAM) credentials.

Mini Shai-Hulud has captured credentials stored in cloud secret stores.

CanisterWorm has gathered credentials from Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.

TeamPCP has used malware to exfiltrate cloud secrets from targeted environments including AWS, GCP, and Azure.

ArcaneDoor included modification of the AAA process to bypass authentication mechanisms.

FIN13 has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications.

Kessel has trojanized the <sode>ssh_login</code> and user-auth_pubkey functions to steal plaintext credentials.

Ebury can intercept private keys using a trojanized ssh-add function.

DRYHOOK has intercepted and logged user credentials by modifying the Perl module in Ivanti Connect Secure VPN edge-devices located within `/home/perl/DSAuth.pm`.

SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.

Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.

Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.

Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.

OilRig has registered a password filter DLL in order to drop malware.

MirrorFace has used a tool named MRSAStealer as a password filter to collect credentials on password changes.

Remsec harvests plain-text credentials as a password filter registered on domain controllers.

Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.

Ebury can deactivate PAM modules to tamper with the sshd configuration.

SYNful Knock has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device.

DRYHOOK has patched victim appliances authentication routines to capture credentials in plaintext as users log in.

SLOWPULSE can modify LDAP and two factor authentication flows by inspecting login credentials and forcing successful authentication if the provided password matches a chosen backdoor password.

During the 2025 Poland Wiper Attacks, the adversaries modified two-factor settings within the FortiGate solution to `unset`.

After compromising user accounts, Scattered Spider registers their own MFA tokens.

SLOWPULSE can insert malicious logic to bypass RADIUS and ACE two factor authentication (2FA) flows if a designated attacker-supplied password is provided.

The AADInternals `Set-AADIntUserMFA` command can be used to disable MFA for a specified user.

APT29 has edited the `Microsoft.IdentityServer.Servicehost.exe.config` file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.

AADInternals can inject a malicious DLL (`PTASpy`) into the `AzureADConnectAuthenticationAgentService` to backdoor Azure AD Pass-Through Authentication.

Scattered Spider has added additional trusted locations to Azure AD conditional access policies.

Storm-0501 has registered their own MFA method, and leveraged a victim hybrid joined server to circumvent Conditional Access Policies.

ArcaneDoor included interception of HTTP traffic to victim devices to identify and parse command and control information sent to the device.