Dump Credentials from Windows Credential Manager With PowerShell — Detection Rule
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.