Enumerate Credentials from Windows Credential Manager With PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects attempts to enumerate credentials from the Windows Credential Manager using PowerShell. It specifically looks for PowerShell script block text containing both 'vaultcmd' and '/listcreds:', combined with keywords like 'Windows Credentials' or 'Web Credentials'. This activity is indicative of an adversary trying to obtain stored user credentials.