mSecure Password Manager Suspicious Activity Alert: Defender's Guide to Vault Protection, Credential Rotation, and Detection

---
title: Suspicious Process Accessing mSecure Local Vault Database
id: 3f9a1c44-7b2d-4e8a-9c61-2a5d8f0b7e34
status: experimental
description: Detects non-mSecure processes opening the mSecure local vault database files, which may indicate vault theft for offline cracking.
references:
  - https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html
  - https://attack.mitre.org/techniques/T1555/
author: Security Arsenal
date: 2026/11/04
tags:
  - attack.credential_access
  - attack.t1555
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\mSecure\'
      - 'mSecure.db'
      - 'mSecure.db-wal'
      - 'mSecure.db-shm'
  filter_legit:
    Image|endswith:
      - '\mSecure.exe'
      - '\MsMpEng.exe'
  condition: selection_target and not filter_legit
falsepositives:
  - Backup and endpoint protection software reading the vault file
  - User-initiated file copies for manual backup
level: high
---
title: Mass Authentication Failures Followed by Success — Possible Credential Stuffing on Cloud Accounts
id: 8c2e5b17-4d6f-4a3b-b7e9-1c3f6a9d2e58
status: experimental
description: Detects a high volume of failed logons followed by a successful logon from the same source, consistent with password spraying or credential stuffing against password manager or downstream accounts.
references:
  - https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html
  - https://attack.mitre.org/techniques/T1110/004/
author: Security Arsenal
date: 2026/11/04
tags:
  - attack.credential_access
  - attack.t1110.004
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
  condition: selection_failed
falsepositives:
  - Misconfigured service accounts
  - Users with expired cached credentials
level: medium
---
title: Archive or Compression of Password Manager Data Directory
id: 5d1b8e62-9a4c-4f7d-a2c3-6e8b4d1f7a29
status: experimental
description: Detects command-line archiving utilities targeting directories commonly associated with password manager local data, a hallmark of vault exfiltration staging.
references:
  - https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/11/04
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
      - '\tar.exe'
      - '\powershell.exe'
  selection_cmd:
    CommandLine|contains:
      - 'mSecure'
      - 'password'
      - 'vault'
      - 'wallet'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate user backup of their own vault
level: high

// Hunt 1: Non-mSecure processes accessing mSecure vault files (Defender for Endpoint)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("mSecure.db", "mSecure.db-wal", "mSecure.db-shm")
    or FolderPath has "mSecure"
| where InitiatingProcessFileName !in~ ("msecure.exe", "msmpeng.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType, AccountName
| order by TimeGenerated desc;

// Hunt 2: Password spray pattern — many failed sign-ins from one source across many accounts (Entra ID / downstream apps)
SigninLogs
| where TimeGenerated > ago(7d)
| summarize FailedAttempts = countif(ResultType != 0), SuccessAfterFail = countif(ResultType == 0), DistinctUsers = dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 1h)
| where FailedAttempts >= 10 and DistinctUsers >= 5
| order by FailedAttempts desc;

// Hunt 3: New device or unusual location sign-ins for accounts (potential vault sync to attacker device)
SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| summarize Devices = make_set(DeviceDetail.displayName), Locations = make_set(Location), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName
| where array_length(Devices) >= 2 or array_length(Locations) >= 2
| project UserPrincipalName, Devices, Locations, FirstSeen, LastSeen;

// Hunt 4: Process execution referencing password manager data (via Sysmon/CommonSecurityLog ingestion)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("mSecure", "msecure.db")
    and FileName !in~ ("msecure.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName;

-- Hunt for processes with open handles or recent execution touching mSecure vault paths,
-- plus any archiving tool execution in user profiles
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)msecure|msecure\.db'
   OR (Name =~ '(?i)7z|rar|tar|winrar|powershell'
       AND CommandLine =~ '(?i)vault|password|msecure')

-- Locate mSecure vault database files across user profiles and capture timestamps for triage
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:/Users/*/AppData/**/mSecure*.db*')
ORDER BY Mtime DESC

# mSecure Event Response - Vault Access Audit & Hardening Script
# Run elevated on endpoints where mSecure desktop is installed

# 1) Enable file system auditing on the mSecure data directory so future access is logged
$msecurePaths = @(
    "$env:LOCALAPPDATA\mSecure",
    "$env:APPDATA\mSecure",
    "$env:USERPROFILE\Documents\mSecure"
)
foreach ($path in $msecurePaths) {
    if (Test-Path $path) {
        $acl = Get-Acl $path
        $rule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            "Everyone","Read,Write,Delete","ContainerInherit,ObjectInherit","None","Success,Failure")
        $acl.AddAuditRule($rule)
        Set-Acl $path $acl
        Write-Output "[+] Auditing enabled on $path"
    }
}

# 2) Review recent file access events touching mSecure vault files (requires prior auditing or Sysmon)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'mSecure' } |
    Select-Object TimeCreated, Message |
    Format-List

# 3) Check for suspicious processes with recent execution referencing the vault
Get-CimInstance Win32_Process |
    Where-Object { $_.CommandLine -match 'mSecure' -and $_.Name -notmatch 'mSecure\.exe' } |
    Select-Object ProcessId, Name, CommandLine, CreationDate

# 4) Force sign-out guidance: enumerate currently logged-on users to coordinate password/2FA reset communication
Get-LocalUser | Where-Object Enabled -eq $true | Select-Object Name, LastLogon