Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1555.005_password-managers
Adversaries may acquire user credentials from third-party password managers.
Passed 23 of 26 test cases with the skill, and 20 of 26 without it.
and 2 more in the full report
4 fixed19 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
When writing threat intelligence reports on advanced persistent threats abusing password vaults, which 2019 threat reports are key references for password manager credential harvesting operations?
| Checked | Without skill | With skill |
|---|---|---|
| Cites the Operation Wocao report by Fox-IT | Missed | Passed |
| Cites the TrickBot Anchor infection report by Cybereason | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1555
Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.
Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory. Adversaries may extract credentials from memory via Exploitation for Credential Access. Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Password Managers by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1555.005 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 20 / 26 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.