Windows Credential Manager Access via VaultCmd

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects attempts to list credentials stored in the Windows Credential Manager using the native Windows utility `vaultcmd.exe`. Specifically, it looks for process creation events where `VaultCmd.exe` is executed with the `/listcreds:` command-line argument, indicating an attempt to enumerate stored credentials.