Procedure examples

Empire can use various modules to search for files containing passwords.

PoshC2 contains modules for searching for passwords in local and remote files.

TruffleHog has obtained credentials stored in config files and credential files in victim environments.

LaZagne can obtain credentials from chats, databases, mail, and WiFi.

Pupy can use Lazagne for harvesting credentials.

QuasarRAT can obtain passwords from FTP clients.

TeamPCP Cloud Stealer has the ability to check over 50 file paths for credentials stored in files across CI/CD, cloud, container, and other environments.

Mini Shai-Hulud has collected credentials stored within configuration files. Mini Shai-Hulud has also gathered credentials from files stored in common credential file paths to include targeting git-credentials, azureProfile.json, and application_default_credentials.json.

ShinyHunters has gathered PII from database infrastructure.

Kali365 has searched compromised mailboxes for credential material such as seed phrases and API keys.

APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.

RedCurl used LaZagne to obtain passwords in the Registry.

VOID MANTICORE had exported credentials from registry hives to include those stored in HKLM.

TrickBot has retrieved PuTTY credentials by querying the Software\SimonTatham\Putty\Sessions registry key

StrelaStealer enumerates the registry key `HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\` to identify the values for "IMAP User," "IMAP Server," and "IMAP Password" associated with the Outlook email application.

Valak can use the clientgrabber module to steal e-mail credentials from the Registry.

IceApple can harvest credentials from local and remote host registries.

Agent Tesla has the ability to extract credentials from the Registry.

PowerSploit has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.

Reg may be used to find credentials in the Windows Registry.

Kinsing has searched bash_history for credentials.

TeamPCP Cloud Stealer can target credentials in shell history on self-hosted runners.

During the SolarWinds Compromise, APT29 obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.

During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.

Kimsuky has accessed a Local State files associated with Chromium-based browsers that contain the AES key used to encrypt passwords stored in the browser to include `app_bound_encrypted_key`.

Volt Typhoon has accessed a Local State file that contains the AES key used to encrypt passwords stored in the Chrome browser.

TeamTNT has searched for unsecured SSH keys.

Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.

Scattered Spider enumerate and exfiltrate code-signing certificates from a compromised host.

Storm-0501 has leveraged the Azure Owner role to access and steal the Storage Account Access keys using the `Microsoft.Storage/storageAccounts/listkeys/action` operation.

Machete has scanned and looked for cryptographic keys and certificate file extensions.

Mafalda can collect a Chrome encryption key used to protect browser cookies.

Hildegard has searched for private keys in .ssh.

FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.

Troll Stealer collects all data in victim `.ssh` folders by creating a compressed copy that is subsequently exfiltrated to command and control infrastructure. Troll Stealer also collects key information associated with the Government Public Key Infrastructure (GPKI) service for South Korean government information systems.

Ebury has intercepted unencrypted private keys as well as private key pass-phrases.

Kinsing has searched for private keys.

jRAT can steal keys for VPNs and cryptocurrency wallets.

AADInternals can gather encryption keys from Azure AD services such as ADSync and Active Directory Federated Services servers.

Empire can use modules like Invoke-SessionGopher to extract private key and session information.

Mimikatz's CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.

TeamPCP Cloud Stealer has searched victim hosts for TLS and SSH keys.

Mini Shai-Hulud has gathered unsecured credentials to include SSH private keys within .ssh.

CanisterWorm has gathered SSH private keys from the .ssh file.

TeamPCP has used malware to extract SSH and GPG keys from victim environments.

TeamTNT has queried the AWS instance metadata service for credentials.

Hildegard has queried the Cloud Instance Metadata API for cloud credentials.

Shai-Hulud has queried the AWS and GCP metadata endpoints for instances and service credentials.

TruffleHog can query the AWS and GCP metadata endpoints for instances and service credentials.

Peirates can query the query AWS and GCP metadata APIs for secrets.