Password Managers

Adversaries may acquire credentials from third-party password managers; ATT&CK also records a procedure example involving a PAM solution. Password-manager databases are normally encrypted and become available after a user unlocks them; credentials may then be copied into client memory, while the encrypted database may be stored on disk. Product and configuration determine whether acquisition exposes master-password or key material, plaintext credentials, or only a protected vault file. Copying an encrypted vault file alone does not establish credential recovery. This entry covers credential acquisition from password stores; generic PAM API or misconfiguration abuse and later use of recovered credentials are separate behaviors.