Credential Manager access via known tools

Detects access to the Windows Credential Manager using built-in utilities such as vaultcmd.exe, cmdkey.exe, rundll32.exe, and control.exe. Adversaries can abuse these native tools to enumerate or interact with stored credentials.

• Platform: Windows
• Severity: Medium
• MITRE Tactic: Credential Access
• MITRE Techniques: T1003, T1003.002

Back to all rules