Atomic Red Team™: T1555.005

Description from ATT&CK

Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019)

Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) Adversaries may extract credentials from memory via Exploitation for Credential Access.(Citation: NVD CVE-2019-3610) Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)

Source

Atomic Tests

Atomic Test #1: KeePass Database File (.kdbx / .kdb) Discovery via PowerShell
Atomic Test #2: KeePass Database File Discovery via Command Prompt
Atomic Test #3: KeePass Configuration and Recent Databases Discovery (KeePass.config.xml)
Atomic Test #4: Staging Discovered KeePass Databases for Exfiltration
Atomic Test #5: KeePass Database Discovery on Linux

Atomic Test #1: KeePass Database File (.kdbx / .kdb) Discovery via PowerShell

Adversaries search filesystem directories (such as user documents, desktop, and temporary folders) for KeePass database files (.kdbx, .kdb) which store encrypted credentials and master databases. This test simulates the discovery technique by creating a test database file with KeePass header magic bytes, scanning the target directory and %TEMP%, and outputting discovered database metadata.

Supported Platforms: Windows

auto_generated_guid: f8431722-3973-4a60-8da8-a53939b19872

Inputs

Name	Description	Type	Default Value
search_path	Root folder to search recursively for KeePass databases	path	$env:USERPROFILE\Documents
test_db_path	Path to create a simulated KeePass database file	path	$env:TEMP\AtomicTest_Vault.kdbx

Attack Commands: Run with `powershell`!

$testDbPath = "#{test_db_path}"
if (-not (Test-Path -LiteralPath $testDbPath)) {
  [IO.File]::WriteAllBytes($testDbPath, [byte[]](0x03, 0xD9, 0xA2, 0x9A, 0x67, 0xFB, 0x4B, 0xB5))
}
Write-Host "Searching for KeePass databases in #{search_path} and temp..."
$results = @(
  Get-ChildItem -Path "#{search_path}" -Filter *.kdb* -Recurse -File -ErrorAction SilentlyContinue
  Get-ChildItem -Path $env:TEMP -Filter *.kdb* -File -ErrorAction SilentlyContinue
) | Where-Object { $_.Extension -in '.kdbx', '.kdb' } | Sort-Object FullName -Unique
$results | Select-Object FullName, Length, LastWriteTime

Cleanup Commands

Remove-Item -LiteralPath "#{test_db_path}" -Force -ErrorAction Ignore

Atomic Test #2: KeePass Database File Discovery via Command Prompt

Adversaries use native Windows command-line utilities (dir /s /b) to recursively locate .kdbx and .kdb database files across user directories and temporary paths.

Supported Platforms: Windows

auto_generated_guid: 804d3fbc-5983-4fb8-9b93-3e43e827f71a

Inputs

Name	Description	Type	Default Value
search_path	Root directory to search for KeePass databases	path	%USERPROFILE%\Documents
test_db_path	Path to simulated KeePass database file	path	%TEMP%\AtomicTest_T1555_005_Cmd\AtomicTest_Vault.kdbx

Attack Commands: Run with `command_prompt`!

if not exist "#{test_db_path}\.." mkdir "#{test_db_path}\.."
echo KeePassHeaderSim > "#{test_db_path}"
dir /s /b "#{search_path}\*.kdb*" 2>nul
dir /s /b "#{test_db_path}\..\*.kdb*" 2>nul

Cleanup Commands

del /f /q "#{test_db_path}" >nul 2>&1
rd "#{test_db_path}\.." >nul 2>&1

Atomic Test #3: KeePass Configuration and Recent Databases Discovery (KeePass.config.xml)

KeePass stores recent database file paths, user preferences, and trigger configurations in KeePass.config.xml. Adversaries inspect this configuration file to locate active database paths or identify trigger execution opportunities. This test creates a simulated KeePass.config.xml in a sandbox folder, reads it to parse the last used database path, and cleans up after execution.

Supported Platforms: Windows

auto_generated_guid: 18306e0d-acd6-4a4d-97d9-d4cfce30103b

Inputs

Name	Description	Type	Default Value
test_config_path	Path to create a simulated KeePass configuration XML file (use a test sandbox, never a real KeePass config)	path	$env:TEMP\AtomicTest_T1555_005\KeePass.config.xml
mock_db_path	Database path referenced in simulated configuration	path	C:\Users\Public\Documents\Company_Vault.kdbx

Attack Commands: Run with `powershell`!

$testConfigPath = "#{test_config_path}"
if ((Test-Path -LiteralPath $testConfigPath) -and ((Get-Content -LiteralPath $testConfigPath -Raw) -notmatch 'AtomicTest T1555\.005')) {
  throw "Refusing to overwrite non-simulated KeePass config at $testConfigPath"
}
$configDir = Split-Path -Parent $testConfigPath
if (-not (Test-Path -LiteralPath $configDir)) { New-Item -ItemType Directory -Path $configDir -Force | Out-Null }
$mockConfig = @"
<?xml version="1.0" encoding="utf-8"?>
<!-- AtomicTest T1555.005 simulated configuration -->
<Configuration>
  <Application>
    <LastUsedFile>
      <Path>#{mock_db_path}</Path>
    </LastUsedFile>
  </Application>
</Configuration>
"@
Set-Content -LiteralPath $testConfigPath -Value $mockConfig -Force
Write-Host "Inspecting simulated KeePass configuration file at ${testConfigPath}:"
[xml]$xml = Get-Content -LiteralPath $testConfigPath
$discoveredDb = $xml.Configuration.Application.LastUsedFile.Path
Write-Host "Discovered last used KeePass database: $discoveredDb"

Cleanup Commands

$testConfigPath = "#{test_config_path}"
if ((Test-Path -LiteralPath $testConfigPath) -and ((Get-Content -LiteralPath $testConfigPath -Raw) -match 'AtomicTest T1555\.005')) {
  Remove-Item -LiteralPath $testConfigPath -Force -ErrorAction Ignore
  $configDir = Split-Path -Parent $testConfigPath
  if ((Test-Path -LiteralPath $configDir) -and (@(Get-ChildItem -LiteralPath $configDir -Force).Count -eq 0)) {
    Remove-Item -LiteralPath $configDir -Force -ErrorAction Ignore
  }
}

Atomic Test #4: Staging Discovered KeePass Databases for Exfiltration

Simulates adversary behavior where discovered KeePass password vaults are copied to a staging directory and compressed into a zip archive prior to exfiltration.

Supported Platforms: Windows

auto_generated_guid: 8df395f6-3568-4b02-b1c5-fd26b25a41df

Inputs

Name	Description	Type	Default Value
source_db	Path to simulated KeePass database file to be staged	path	$env:TEMP\AtomicTest_Target.kdbx
staging_dir	Temporary directory used to stage collected password vaults	path	$env:PUBLIC\T1555_005_Staging
archive_file	Destination zip archive file path	path	$env:PUBLIC\T1555_005_Vaults.zip

Attack Commands: Run with `powershell`!

$sourceDb = "#{source_db}"
$stagingDir = "#{staging_dir}"
$archivePath = "#{archive_file}"
if (-not (Test-Path -LiteralPath $sourceDb)) {
  [IO.File]::WriteAllBytes($sourceDb, [byte[]](0x03, 0xD9, 0xA2, 0x9A, 0x67, 0xFB, 0x4B, 0xB5))
}
if (-not (Test-Path -LiteralPath $stagingDir)) {
  New-Item -ItemType Directory -Path $stagingDir -Force | Out-Null
}
Copy-Item -LiteralPath $sourceDb -Destination "$stagingDir\" -Force
Write-Host "Staging databases to ${stagingDir}:"
Get-ChildItem -LiteralPath $stagingDir
if (Test-Path -LiteralPath $archivePath) { Remove-Item -LiteralPath $archivePath -Force }
Add-Type -Assembly System.IO.Compression.FileSystem
[IO.Compression.ZipFile]::CreateFromDirectory($stagingDir, $archivePath)
Write-Host "Created archive at ${archivePath}: $((Get-Item -LiteralPath $archivePath).Length) bytes"

Cleanup Commands

Remove-Item -LiteralPath "#{source_db}" -Force -ErrorAction Ignore
Remove-Item -LiteralPath "#{staging_dir}" -Recurse -Force -ErrorAction Ignore
Remove-Item -LiteralPath "#{archive_file}" -Force -ErrorAction Ignore

Atomic Test #5: KeePass Database Discovery on Linux

Adversaries locate .kdbx and .kdb password manager databases on Linux systems by scanning common user directories and temporary paths.

Supported Platforms: Linux

auto_generated_guid: 13084353-4ffc-4655-a790-07fddd2ae720

Inputs

Name	Description	Type	Default Value
test_dir	Path to temporary directory simulating user database folder	path	/tmp/atomic_t1555_005

Attack Commands: Run with `sh`!

mkdir -p "#{test_dir}" && touch "#{test_dir}/passwords.kdbx"
echo "Searching for KeePass databases in #{test_dir}..."
find "#{test_dir}" \( -name "*.kdbx" -o -name "*.kdb" \) -print 2>/dev/null

Cleanup Commands

rm -f "#{test_dir}/passwords.kdbx"
rmdir "#{test_dir}" 2>/dev/null || true

Atomic test(s) for this technique last updated: 2026-11-06 02:41:11 UTC

T1555.005

Description from ATT&CKCopy Anchor Link

Atomic TestsCopy Anchor Link

Atomic Test #1: KeePass Database File (.kdbx / .kdb) Discovery via PowerShellCopy Anchor Link

InputsCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #2: KeePass Database File Discovery via Command PromptCopy Anchor Link

InputsCopy Anchor Link

Attack Commands: Run with command_prompt!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #3: KeePass Configuration and Recent Databases Discovery (KeePass.config.xml)Copy Anchor Link

InputsCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #4: Staging Discovered KeePass Databases for ExfiltrationCopy Anchor Link

InputsCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #5: KeePass Database Discovery on LinuxCopy Anchor Link

InputsCopy Anchor Link

Attack Commands: Run with sh!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

On this page

Description from ATT&CK

Atomic Tests

Atomic Test #1: KeePass Database File (.kdbx / .kdb) Discovery via PowerShell

Inputs

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #2: KeePass Database File Discovery via Command Prompt

Inputs

Attack Commands: Run with `command_prompt`!

Cleanup Commands

Atomic Test #3: KeePass Configuration and Recent Databases Discovery (KeePass.config.xml)

Inputs

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #4: Staging Discovered KeePass Databases for Exfiltration

Inputs

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #5: KeePass Database Discovery on Linux

Inputs

Attack Commands: Run with `sh`!

Cleanup Commands