Detection of Password Manager and Credential Discovery Activity

This threat brief focuses on common adversary behavior involving the discovery of sensitive local files, specifically password manager databases and credential stores. Attackers leverage native Windows command-line utilities, including 'dir' and 'findstr', to scan filesystems for artifacts such as '.kdbx', 'credential', and 'Ntds.dit'. This discovery phase is a precursor to post-exploitation activities, including credential harvesting, lateral movement, and data exfiltration. Observed in campaigns associated with Prestige Ransomware, Scattered Spider, and various stealer malware, this activity highlights the necessity of monitoring command-line process telemetry for reconnaissance patterns. By identifying these searches in real-time, security operations teams can detect unauthorized attempts to map the local attack surface before secrets are accessed or extracted.

Impact

Successful execution of these discovery commands enables attackers to identify the location of high-value targets, such as password vaults and active directory databases. If the attacker subsequently exfiltrates these files or extracts credentials, it can result in full account compromise, domain-wide privilege escalation, and massive data breaches within the targeted organization.

Recommendation

• Deploy the provided Sigma rule to monitor for process executions involving common reconnaissance patterns against sensitive file extensions.
• Enable Sysmon (Event ID 1) or Windows Security Event Logs (Event ID 4688) to capture detailed command-line arguments for all process executions.
• Establish alerting thresholds for 'dir' or 'findstr' commands when the arguments target known sensitive file types.
• Review and tune the detection logic to account for legitimate system administration scripts that may query similar paths.