Credential Access via Windows Credential Manager PowerShell Scripts

Adversaries frequently target the Windows Credential Manager to perform credential access, as this utility stores sensitive user passwords, service account credentials, and web application secrets. Attackers utilize PowerShell scripts to interface with the Windows.Security.Credentials.PasswordVault API or dynamically compile code to bypass standard monitoring. By invoking these methods, unauthorized actors can enumerate and decrypt secrets stored within the vault. This activity is a common post-exploitation technique used to facilitate lateral movement or privilege escalation within an environment. Defenders must monitor PowerShell Script Block Logging (Event ID 4104) to identify the execution of these specific API calls and helper classes used by offensive tools to dump credentials.

Attack Chain

1. Attacker gains initial access or code execution on the target Windows system.
2. Attacker prepares a PowerShell script intended to interact with the Windows Credential Manager.
3. Script uses New-Object to instantiate the Windows.Security.Credentials.PasswordVault class.
4. Script may utilize Microsoft.CSharp.CSharpCodeProvider to compile arbitrary code in memory to interact with system APIs.
5. Script invokes methods like Get-PasswordVaultCredentials or Get-CredManCreds to retrieve stored data.
6. The retrieved credentials are serialized or stored in an ArrayList within the script.
7. Attacker exfiltrates the dumped credentials from the compromised host to attacker-controlled infrastructure.

Impact

Successful exploitation allows an attacker to obtain cleartext credentials or cached tokens for local and domain users, enabling unauthorized access to internal resources, sensitive applications, and increased privileges within the target organization.

Recommendation

Deploy the following Sigma rule to detect credential dumping attempts via PowerShell. Ensure PowerShell Script Block Logging is enabled on all endpoints.

• Enable Windows Event ID 4104 (PowerShell Script Block Logging) via Group Policy.
• Monitor for the execution of scripts containing 'Windows.Security.Credentials.PasswordVault' or associated compiler classes.
• Tune alerts to ignore approved administrative maintenance scripts that legitimately interact with the system vault.