third party software might leverage this dll in order to make use of the credential manager feature via the provided exports. typically the vaultcli.dll module is loaded by the vaultcmd.exe windows utility to interact with the windows credential manager for secure storage and retrieval of credentials.

Techniques

T1555.004

Sample rules

Windows Credentials Access via VaultCli Module

source: splunk
technicques:
- T1555.004

Description

The following analytic detects potentially abnormal interactions with VaultCLI.dll, particularly those initiated by processes located in publicly writable Windows folder paths. The VaultCLI.dll module allows processes to extract credentials from the Windows Credential Vault. It was seen being abused by information stealers such as Meduza. The analytic monitors suspicious API calls, unauthorized credential access patterns, and anomalous process behaviors indicative of malicious activity. By leveraging a combination of signature-based detection and behavioral analysis, it effectively flags attempts to misuse the vault for credential theft, enabling swift response to protect sensitive user data and ensure system security.

Detection logic

`sysmon` EventCode=7  ImageLoaded ="*\\vaultcli.dll" process_path IN("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\appdata\\local\\temp\\*", "*\\PerfLogs\\*", "*:\\temp\\*") 
| stats count min(_time) as firstTime max(_time) as lastTime by dest Image ImageLoaded process_name EventCode Signed ProcessId 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_credentials_access_via_vaultcli_module_filter`