name: Credential discovery via VaultCmd.exe
id: 2ce607d3-5a14-4628-be8a-22bcde97dab5
version: 1.0.0
description: |
  Detects the usage of the VaultCmd tool to list Windows Credentials.
  VaultCmd creates, displays and deletes stored credentials.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1555
  technique.name: Credentials from Password Stores
  technique.ref: https://attack.mitre.org/techniques/T1555/
  subtechnique.id: T1555.004
  subtechnique.name: Windows Credential Manager
  subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/

condition: >
  spawn_process
    and
  ps.child.name ~= 'VaultCmd.exe'
    and
  ps.child.args in
    (
      '"/listcreds:Windows Credentials"',
      '"/listcreds:Web Credentials"'
    )

min-engine-version: 2.0.0
