Loading story…
Elastic Endpoint Security added kernel-driver-derived file and registry telemetry to detect access to sensitive credential stores, including browser data, Windows SAM and LSA secrets, cached domain credentials, credential files, and Windows Credential Manager. Its behavior protections can block high-confidence credential-theft activity associated with tools and malware such as Mimikatz, LaZagne, AgentTesla, FormBook, and Poulight Stealer; KQL and EQL hunting can also identify processes opening multiple sensitive stores or SMB access following a network logon.
Attackers commonly extract saved browser usernames, passwords, cookies, and session tokens from stores such as Chrome’s Login Data and Firefox’s key3.db, key4.db, and logins.json. They also dump Windows LSA secrets and cached domain credentials using utilities including Mimikatz, reg save, Impacket secretsdump.py, CrackMapExec, and gsecdump. Cached Windows credentials are generally stored as DCC2/MS-Cache v2 hashes and require offline cracking rather than pass-the-hash, while Linux Active Directory integrations may retain cached credentials in SSSD or Quest database files.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Elastic Endpoint Security 7.15 introduced kernel-driver-derived file and registry access telemetry for sensitive credential stores, including browser data, SAM, LSA secrets, cached domain credentials, credential files, and Windows Credential Manager. The release also added behavior-protection rules and KQL/EQL hunting patterns for suspected credential theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors and malware are continuing to harvest credentials from files, configuration stores, and application artifacts on compromised systems, a technique tracked as **MITRE ATT&CK `T1552.001`**. Common targets include browser password stores, email and chat clients, FTP/VPN/SSH tools, cloud credential files, and infrastructure secrets such as Docker or Kubernetes tokens. MITRE’s mappings show groups including **Fox Kitten** and **FIN13** combining this activity with broader credential theft such as **LSASS** dumping, **NTDS.dit** extraction, registry hive theft, and collection of KeePass databases after gaining access through exploited public-facing applications, VPN appliances, remote services, or default credentials. Defenders are also tracking this behavior in enterprise tools that store access secrets locally. Splunk published a Windows analytic that flags **Security Event ID `4663`** when any process other than `winscp.exe` accesses the WinSCP configuration security folder, which may contain SSH and FTP credentials, passwords, and private key references. The detection is intended to catch possible credential theft, including activity linked to information stealers such as **Phantom Stealer**, and Splunk advises investigators to review the accessing process, its parent process, and related network activity while accounting for benign access from backup or antivirus software.
Jul 13, 2026
Security researchers highlighted multiple Windows credential exposure paths that can hand attackers plaintext passwords without requiring noisy `LSASS` dumping. Common sources include PowerShell command history stored in `ConsoleHost_History.txt`, plaintext files and stealer logs, exposed Active Directory attributes, and legacy Group Policy Preferences (`GPP`) XML files in `SYSVOL` that may still contain decryptable `cpassword` values accessible to authenticated domain users. The reporting also described more persistent credential-harvesting techniques that abuse legitimate Windows authentication components, including malicious Security Support Providers, password filter DLLs, and network provider DLLs to capture credentials during logon or password changes. Defenders were urged to remove vulnerable `GPP` artifacts, deploy protections such as Microsoft's `LAPS`, audit systems for exposed secrets and suspicious registry or file changes, and monitor for abuse of PowerShell history and authentication-related components with tools such as Sysmon.
Aug 1, 2026
Elastic Security Labs published a series of Linux detection-engineering guides covering attacker persistence through scheduled tasks, `systemd` units, shell profiles, XDG autostart, permission and account changes, SSH keys, SysV/Upstart/`rc.local` startup paths, dynamic MOTD scripts, udev rules, package-manager hooks, Git hooks, process capabilities, and system-binary hijacking. The research maps techniques to MITRE ATT&CK and uses the PANIX simulation tool to demonstrate how adversaries can retain access or launch reverse shells, while recommending endpoint, file-integrity, process, network, service-state, and syslog telemetry alongside Elastic rules, ES|QL, and OSQuery hunts. The latest guidance highlights high-impact persistence through malicious PAM changes, DPKG/RPM lifecycle scripts, and dangerous Docker deployments. Defenders should monitor PAM and package-management paths, suspicious child processes and outbound connections, lifecycle-script execution, and container settings such as privileged mode, host PID namespaces, and sensitive host mounts. Elastic cautions that boot-time persistence may execute before endpoint agents collect process events, making early file-change detection and proactive hunting essential; organizations should also tune detections for legitimate administration and remove obsolete Upstart systems from production.
Sep 9, 2026