AN1641
Analytic 1641
Windows
Detection of suspicious access to password manager processes (KeePass, 1Password, LastPass, Bitwarden) through abnormal process injection, memory reads, or command-line usage of vault-related DLLs. Correlates process creation with OS API calls and file access to vault databases (.kdbx, .opvault, .ldb).
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=15
[PasswordManagerBinaries]
List of monitored binaries and file formats for password managers in use (e.g., KeePass, 1Password, Bitwarden, LastPass).
[TimeWindow]
Window to correlate process creation, API access, and file reads indicative of credential extraction.
[UserContext]
Filter for administrative accounts vs. expected users of password managers.
AN1642
Analytic 1642
Linux
Suspicious access to password manager vaults (KeePassXC, gnome-keyring, pass) via memory scraping or unauthorized file reads. Detects unusual command execution involving gdb/strace attached to password manager processes.
auditd:SYSCALL
open/read on ~/.local/share/keepassxc/* OR ~/.password-store/*
auditd:SYSCALL
ptrace
[VaultFilePaths]
Linux paths to monitor for vault database files (KeePassXC, pass, gnome-keyring).
[TimeWindow]
Correlation interval to detect multiple suspicious access events.
AN1643
Analytic 1643
macOS
Detection of password manager database access (1Password .opvault, LastPass caches, KeePass .kdbx) outside expected parent processes. Identifies memory scraping attempts via suspicious API calls or tools attaching to password manager processes.
macos:unifiedlog
security OR injection attempts into 1Password OR LastPass
macos:unifiedlog
*.opvault OR *.ldb OR *.kdbx
macos:osquery
unexpected memory inspection
[VaultFileExtensions]
Password manager file extensions (.opvault, .kdbx, .ldb) to monitor for anomalous access.
[ParentProcessWhitelist]
Expected parent processes that normally access password manager files, for filtering false positives.