ATT&CK technique · T1555
Credentials from Password Stores
Credential Access· seen in 9 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-2872 KEV CVEsImproper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-2882 KEV CVEsAuthentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
- CWE-2902 KEV CVEsAuthentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
- CWE-1251 KEV CVEOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-221 KEV CVEImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Sequences like ../ in a file path escape the intended folder, exposing or overwriting other files.
- CWE-231 KEV CVERelative Path TraversalRelative ../ segments in input climb out of the allowed directory.
- CWE-3061 KEV CVEMissing Authentication for Critical FunctionA sensitive function requires no login at all; one of the most exploited flaws in edge devices.
- CWE-3461 KEV CVEOrigin Validation ErrorThe software doesn't verify where a message really came from, so forged messages are trusted.
Controls that mitigate it (8)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CA · Security Assessment and Authorization
CM · Configuration Management
IA · Identification and Authentication
SI · System and Information Integrity
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.