Unsecured Credentials

T1552

Technique with 8 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Detection rules83

Rules on DetectionCode tagged with T1552 or one of its sub-techniques.

Sigma49

Rule	Level	Log source	Technique
Application AppID Uri Configuration Changes	high	azure / NULL	T1552
Cisco Crypto Commands	high	cisco / NULL	T1552.004
Copy Passwd Or Shadow From TMP Path	high	linux / process_creation	T1552.001
Credentials In Files	high	macos / process_creation	T1552.001
Credentials In Files - Linux	high	linux / NULL	T1552.001
DPAPI Backup Keys And Certificate Export Activity IOC	high	windows / file_event	T1552.004
Findstr GPP Passwords	high	windows / process_creation	T1552.006
HackTool - Typical HiveNightmare SAM File Export	high	windows / file_event	T1552.001
HackTool - WinPwn Execution	high	windows / process_creation	T1552.001
HackTool - WinPwn Execution - ScriptBlock	high	windows / ps_script	T1552.001
Linux Recon Indicators	high	linux / process_creation	T1552.001
LSASS Process Reconnaissance Via Findstr.EXE	high	windows / process_creation	T1552.006
Potential Okta Password in AlternateID Field	high	okta / NULL	T1552
PowerShell Get-Process LSASS	high	windows / process_creation	T1552.004
Registry Export of Third-Party Credentials	high	windows / process_creation	T1552.002
SAM Registry Hive Handle Request	high	windows / NULL	T1552.002
Script Interpreter Spawning Credential Scanner - Linux	high	linux / process_creation	T1552
Script Interpreter Spawning Credential Scanner - Windows	high	windows / process_creation	T1552
Access To Potentially Sensitive Sysvol Files By Uncommon Applications	medium	windows / file_access	T1552.006
Added Owner To Application	medium	azure / NULL	T1552
Automated Collection Command Prompt	medium	windows / process_creation	T1552.001
Azure Key Vault Modified or Deleted	medium	azure / NULL	T1552 T1552.001
Azure Keyvault Key Modified or Deleted	medium	azure / NULL	T1552 T1552.001
Azure Keyvault Secrets Modified or Deleted	medium	azure / NULL	T1552 T1552.001
Azure Kubernetes Admission Controller	medium	azure / NULL	T1552 T1552.007
Certificate Exported Via PowerShell	medium	windows / process_creation	T1552.004
Certificate Exported Via PowerShell - ScriptBlock	medium	windows / ps_script	T1552.004
Cisco Show Commands Input	medium	cisco / NULL	T1552.003
Enumeration for 3rd Party Creds From CLI	medium	windows / process_creation	T1552.002
Enumeration for Credentials in Registry	medium	windows / process_creation	T1552.002
Extracting Information with PowerShell	medium	windows / ps_script	T1552.001
Google Cloud Kubernetes Admission Controller	medium	gcp / NULL	T1552 T1552.007
Hidden Flag Set On File/Directory Via Chflags - MacOS	medium	macos / process_creation	T1552.001
Kubernetes Admission Controller Modification	medium	kubernetes / NULL	T1552 T1552.007
Permission Misconfiguration Reconnaissance Via Findstr.EXE	medium	windows / process_creation	T1552.006
Potential PowerShell Console History Access Attempt via History File	medium	windows / process_creation	T1552.001
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities	medium	windows / process_creation	T1552
Potentially Suspicious JWT Token Search Via CLI	medium	windows / process_creation	T1552.001
Private Keys Reconnaissance Via CommandLine Tools	medium	windows / process_creation	T1552.004
PUA - TruffleHog Execution	medium	windows / process_creation	T1552.001
PUA - TruffleHog Execution - Linux	medium	linux / process_creation	T1552.001
Remote File Download Via Findstr.EXE	medium	windows / process_creation	T1552.001
Suspicious History File Operations	medium	macos / process_creation	T1552.003
Suspicious History File Operations - Linux	medium	linux / NULL	T1552.003
Suspicious PFX File Creation	medium	windows / file_event	T1552.004
Suspicious SYSVOL Domain Group Policy Access	medium	windows / process_creation	T1552.006
Cisco Collect Data	low	cisco / NULL	T1552.001
Insensitive Subfolder Search Via Findstr.EXE	low	windows / process_creation	T1552.001
Kubernetes Secrets Enumeration	low	kubernetes / application	T1552.007

Splunk34

Rule	Type	Risk	Data source	Technique
Add DefaultUser And Password In Registry	Anomaly	NULL	Sysmon EventID 12, Sysmon EventID 13	T1552.002
Auto Admin Logon Registry Entry	TTP	NULL	Sysmon EventID 13	T1552.002
Cisco Isovalent - Access To Cloud Metadata Service	Anomaly	NULL	Cisco Isovalent Process Connect	T1552.005
Cisco SNMP Community String Configuration Changes	Anomaly	NULL	Cisco IOS Logs	T1552
Detect AWS Console Login by New User	Hunting	NULL	AWS CloudTrail	T1552
Kubernetes Abuse of Secret by Unusual Location	Anomaly	NULL	Kubernetes Audit	T1552.007
Kubernetes Abuse of Secret by Unusual User Agent	Anomaly	NULL	Kubernetes Audit	T1552.007
Kubernetes Abuse of Secret by Unusual User Group	Anomaly	NULL	Kubernetes Audit	T1552.007
Kubernetes Abuse of Secret by Unusual User Name	Anomaly	NULL	Kubernetes Audit	T1552.007
Linux Auditd Find Private Keys	TTP	NULL	Linux Auditd Execve	T1552.004
Linux Auditd Find Ssh Private Keys	Anomaly	NULL	Linux Auditd Execve	T1552.004
Linux Auditd Private Keys and Certificate Enumeration	Anomaly	NULL	Linux Auditd Execve	T1552.004
Linux Shell History Access Via Command Line Utility	Anomaly	NULL	Sysmon for Linux EventID 1	T1552.003
MCP Github Suspicious Operation	Hunting	NULL	MCP Server	T1552.001
MCP Sensitive System File Search	Hunting	NULL	MCP Server	T1552.001
O365 Email Suspicious Search Behavior	Anomaly	NULL	Office 365 Universal Audit Log	T1552
O365 SharePoint Suspicious Search Behavior	Anomaly	NULL	Office 365 Universal Audit Log	T1552
Potential password in username	Hunting	NULL	Linux Secure	T1552.001
Shai-Hulud 2 Exfiltration Artifact Files	TTP	NULL	Sysmon for Linux EventID 11, Sysmon EventID 11	T1552.001
Splunk Sensitive Information Disclosure in DEBUG Logging Channels	Hunting	NULL	Splunk	T1552
Windows Credentials in Registry Reg Query	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1552.002
Windows Export Certificate	Anomaly	NULL	Windows Event Log CertificateServicesClient 1007	T1552.004
Windows Findstr GPP Discovery	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1552.006
Windows LAPS Password Gathering Via PowerShell Script	Anomaly	NULL	Powershell Script Block Logging 4104	T1552
Windows Post Exploitation Risk Behavior	Correlation	NULL		T1552
Windows PowerShell Export Certificate	Anomaly	NULL	Powershell Script Block Logging 4104	T1552.004
Windows PowerShell Export PfxCertificate	Anomaly	NULL	Powershell Script Block Logging 4104	T1552.004
Windows PowerSploit GPP Discovery	TTP	NULL	Powershell Script Block Logging 4104	T1552.006
Windows Private Keys Discovery	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1552.004
Windows SharePoint Spinstall0 GET Request	TTP	NULL	Suricata	T1552
Windows Unsecured Outlook Credentials Access In Registry	Anomaly	NULL	Windows Event Log Security 4663	T1552
Windows Unusual FileZilla XML Config Access	Anomaly	NULL	Windows Event Log Security 4663	T1552.001
Windows Unusual Intelliform Storage Registry Access	Anomaly	NULL	Windows Event Log Security 4663	T1552.001
Windows WinSCP Configuration Security Access	Anomaly	NULL	Windows Event Log Security 4663	T1552.001

Sub-techniques8

ID	Name	Examples
T1552.001	Credentials In Files	41
T1552.002	Credentials in Registry	10
T1552.003	Shell History	2
T1552.004	Private Keys	23
T1552.005	Cloud Instance Metadata API	6
T1552.006	Group Policy Preferences	5
T1552.007	Container API	3
T1552.008	Chat Messages	1

Groups1

Volt Typhoon

Software4

Astaroth DarkGate NPPSPY Pacu

Campaigns1

Leviathan Australian Intrusions

Procedure examples6

Groups1

Used by	Procedure example
GroupVolt Typhoon	Volt Typhoon has obtained credentials insecurely stored on targeted network appliances. CISA AA24-038A PRC Critical Infrastructure February 2024

Software4

Used by	Procedure example
MalwareAstaroth	Astaroth uses an external software known as NetPass to recover passwords. Cybereason Astaroth Feb 2019
MalwareDarkGate	DarkGate uses NirSoft tools to steal user credentials from the infected machine. NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe. Ensilo Darkgate 2018
ToolNPPSPY	NPPSPY captures credentials by recording them through an alternative network listener registered to the `mpnotify.exe` process, allowing for cleartext recording of logon information. Huntress NPPSPY 2022
ToolPacu	Pacu can search for sensitive data: for example, in Code Build environment variables, EC2 user data, and Cloud Formation templates. GitHub Pacu

Campaigns1

Used by	Procedure example
CampaignLeviathan Australian Intrusions	Leviathan gathered credentials hardcoded in binaries located on victim devices during Leviathan Australian Intrusions. CISA Leviathan 2024

References1

Brining MimiKatz to Unix Open source
Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.