{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--cc6e0637-76d2-4af3-a604-9d8d3ff8a6b3",
  "created": "2022-04-01T14:55:10.494Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T1634",
      "external_id": "T1634"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-11.html",
      "external_id": "AUT-11"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2025-10-24T17:49:23.749Z",
  "name": "Credentials from Password Store",
  "description": "Adversaries may search common password storage locations to obtain user credentials. Passwords can be stored in several places on a device, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users to manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-mobile-attack",
      "phase_name": "credential-access"
    }
  ],
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "mobile-attack"
  ],
  "x_mitre_is_subtechnique": false,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "iOS"
  ],
  "x_mitre_version": "1.1",
  "x_mitre_tactic_type": [
    "Post-Adversary Device Access"
  ]
}