Credentials from Password Stores

Adversaries may obtain user credentials from third-party password managers. These applications normally keep credentials in encrypted vault databases that can be stored as files; credentials may become available after the vault is unlocked or its master password is obtained. Browser credential stores are covered separately by ATT&CK T1555.003.