{"id":"T1552.001","name":"Credentials In Files","url":"https://attack.mitre.org/techniques/T1552/001","tactics":["credential-access"],"platforms":["Containers","IaaS","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0307","stix_id":"x-mitre-detection-strategy--b34a9911-8261-45b4-af09-3885f9b82cc6","name":"Detect Access to Unsecured Credential Files Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0307","analytics":[{"id":"AN0856","stix_id":"x-mitre-analytic--0277e29a-af6d-4242-a187-32673328664a","name":"Analytic 0856","description":"Correlated file access to insecure credential files (e.g., *.env, *.xml, *.ps1) followed by suspicious process execution or authentication using retrieved credentials. Detected through Sysmon logs and Windows Security Event logs.","url":"https://attack.mitre.org/detectionstrategies/DET0307#AN0856","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"FileNamePattern","description":"Patterns like *.env, *credential* can be tuned to reduce noise or catch custom implementations"},{"field":"ProcessAccessScope","description":"Defines scope of access (e.g., only untrusted parent processes or high-risk processes)"},{"field":"TimeWindow","description":"Time delta between credential file access and use in logon attempt"}],"live":true,"detection_strategies":["DET0307"],"techniques":["T1552.001"]},{"id":"AN0857","stix_id":"x-mitre-analytic--7ff5d08a-5d4d-4260-85ee-fdb6a244f258","name":"Analytic 0857","description":"File reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.","url":"https://attack.mitre.org/detectionstrategies/DET0307#AN0857","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open/read of sensitive config or secret files","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:EXECVE","channel":"grep/cat/awk on files with password fields","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-execve"},{"name":"linux:syslog","channel":"authentication success after file access","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"RegexPatterns","description":"Patterns like password, secret, token can be expanded or customized"},{"field":"UserContextScope","description":"Scope of users monitored (e.g., root vs all users)"},{"field":"TimeWindow","description":"Time between suspicious file access and credential use"}],"live":true,"detection_strategies":["DET0307"],"techniques":["T1552.001"]},{"id":"AN0858","stix_id":"x-mitre-analytic--df289d0f-0f31-487e-b213-9a492d903f2c","name":"Analytic 0858","description":"Terminal-based grep or open of plist/config files containing credentials, correlated with Keychain or system login attempts.","url":"https://attack.mitre.org/detectionstrategies/DET0307#AN0858","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"grep/cat on files matching credential patterns","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"open/read of *.plist or .env files","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Keychain or user login post-access","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"KeychainToolAccess","description":"Monitor unexpected use of security CLI or Keychain helper binaries"},{"field":"FileTypeList","description":"Add or remove watched file types based on system usage"}],"live":true,"detection_strategies":["DET0307"],"techniques":["T1552.001"]},{"id":"AN0859","stix_id":"x-mitre-analytic--9c5d279c-eb09-4592-91a4-8cf6436522b6","name":"Analytic 0859","description":"Container processes accessing mounted secrets or configuration paths (e.g., /run/secrets, /mnt/config) followed by network access or credential use.","url":"https://attack.mitre.org/detectionstrategies/DET0307#AN0859","platforms":["Containers"],"log_source_references":[{"name":"ebpf:syscalls","channel":"open/read on secret mount paths","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"ebpf-syscalls"},{"name":"kubernetes:audit","channel":"process execution involving curl, grep, or awk on secrets","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"kubernetes-audit"},{"name":"cni:netflow","channel":"outbound connection to internal or external APIs","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"cni-netflow"}],"mutable_elements":[{"field":"SecretMountPaths","description":"Customize based on deployment structure (e.g., /mnt/, /run/secrets/)"},{"field":"ProcessBaselineDeviation","description":"Tune anomaly scoring for container image deviations"}],"live":true,"detection_strategies":["DET0307"],"techniques":["T1552.001"]},{"id":"AN0860","stix_id":"x-mitre-analytic--01d19202-019e-43c9-a5e9-e1e2a38eb738","name":"Analytic 0860","description":"Access to local credential/config files (e.g., ~/.aws/credentials) followed by metadata API calls or cloud role assumptions.","url":"https://attack.mitre.org/detectionstrategies/DET0307#AN0860","platforms":["IaaS"],"log_source_references":[{"name":"CloudTrail:GetObject","channel":"sensitive credential files in buckets or local image storage","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"cloudtrail-getobject"},{"name":"AWS:CloudTrail","channel":"command-line execution invoking credential enumeration","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"sudden role assumption after credential file access","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"CredentialFilePattern","description":"Regex to match common credential files (e.g., *.aws/credentials, token.txt)"},{"field":"RoleAssumptionScope","description":"Adjust scope of roles monitored (e.g., admin, service accounts)"},{"field":"TimeWindow","description":"Correlation timing between file access and AssumeRole"}],"live":true,"detection_strategies":["DET0307"],"techniques":["T1552.001"]}],"live":true,"version":"1.0","techniques":["T1552.001"]}],"sigma_rules":[{"id":"04936b66-3915-43ad-a8e5-809eadfd1141","title":"Insensitive Subfolder Search Via Findstr.EXE","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2020-10-05","modified":"2024-03-05","description":"Detects execution of findstr with the \"s\" and \"i\" flags for a \"subfolder\" and \"insensitive\" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Findstr/","https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml","techniques":["T1218","T1564.004","T1552.001","T1105"],"cves":[]},{"id":"0aba5685-6db6-486f-88ef-29a99c545cfd","title":"Shai-Hulud Malicious GitHub Workflow Creation","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-09-24","modified":"2026-01-24","description":"Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets","references":["https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.persistence","attack.credential-access","attack.t1552.001","attack.collection","attack.t1119","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/Shai-Hulud/file_event_lnx_mal_shai_hulud_workflow.yml","techniques":["T1552.001","T1119"],"cves":[]},{"id":"0cf7a157-8879-41a2-8f55-388dd23746b7","title":"Linux Recon Indicators","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-20","modified":null,"description":"Detects events with patterns found in commands used for reconnaissance on linux systems","references":["https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.reconnaissance","attack.t1592.004","attack.credential-access","attack.t1552.001"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml","techniques":["T1592.004","T1552.001"],"cves":[]},{"id":"1a0f6f16-2099-4753-9a02-43b6ac7a1fa5","title":"Potential Password Reconnaissance Via Findstr.EXE","author":"Josh Nickels","status":"test","level":"medium","date":"2023-05-18","modified":null,"description":"Detects command line usage of \"findstr\" to search for the \"passwords\" keyword in a variety of different languages","references":["https://steflan-security.com/windows-privilege-escalation-credential-harvesting/","https://adsecurity.org/?p=2288"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_findstr_password_recon.yml","techniques":["T1552.001"],"cves":[]},{"id":"3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe","title":"Hidden Flag Set On File/Directory Via Chflags - MacOS","author":"Omar Khaled (@beacon_exe)","status":"test","level":"medium","date":"2024-08-21","modified":null,"description":"Detects the execution of the \"chflags\" utility with the \"hidden\" flag, in order to hide files on MacOS.\nWhen a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.\n","references":["https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/","https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/","https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf","https://ss64.com/mac/chflags.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"path":"rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml","techniques":["T1218","T1564.004","T1552.001","T1105"],"cves":[]},{"id":"44030449-b0df-4c94-aae1-502359ab28ee","title":"PUA - TruffleHog Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-09-24","modified":null,"description":"Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.\nWhile it is a legitimate tool, intended for use in CI pipelines and security assessments,\nIt was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.\n","references":["https://github.com/trufflesecurity/trufflehog","https://www.getsafety.com/blog-posts/shai-hulud-npm-attack"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.credential-access","attack.t1083","attack.t1552.001"],"path":"rules/windows/process_creation/proc_creation_win_pua_trufflehog.yml","techniques":["T1083","T1552.001"],"cves":[]},{"id":"459a2970-bb84-4e6a-a32e-ff0fbd99448d","title":"Azure Key Vault Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-16","modified":"2022-08-23","description":"Identifies when a key vault is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1552","attack.t1552.001"],"path":"rules/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml","techniques":["T1552","T1552.001"],"cves":[]},{"id":"53b1b378-9b06-4992-b972-dde6e423d2b4","title":"Credentials In Files","author":"Igor Fits, Mikhail Larin, oscd.community","status":"test","level":"high","date":"2020-10-19","modified":"2021-11-27","description":"Detecting attempts to extract passwords with grep and laZagne","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.001"],"path":"rules/macos/process_creation/proc_creation_macos_find_cred_in_files.yml","techniques":["T1552.001"],"cves":[]},{"id":"587254ee-a24b-4335-b3cd-065c0f1f4baa","title":"Remote File Download Via Findstr.EXE","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-10-05","modified":"2024-03-05","description":"Detects execution of \"findstr\" with specific flags and a remote share path. This specific set of CLI flags would allow \"findstr\" to download the content of the file located on the remote share as described in the LOLBAS entry.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Findstr/","https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_findstr_download.yml","techniques":["T1218","T1564.004","T1552.001","T1105"],"cves":[]},{"id":"6d3a3952-6530-44a3-8554-cf17c116c615","title":"Potentially Suspicious JWT Token Search Via CLI","author":"Nasreddine Bencherchali (Nextron Systems), kagebunsher","status":"test","level":"medium","date":"2022-10-25","modified":"2025-10-21","description":"Detects potentially suspicious search for JWT tokens via CLI by looking for the string \"eyJ0eX\" or \"eyJhbG\".\nJWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.\nThreat actors may search for these tokens to steal them for lateral movement or privilege escalation.\n","references":["https://mrd0x.com/stealing-tokens-from-office-applications/","https://www.scip.ch/en/?labs.20240523"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1528","attack.t1552.001"],"path":"rules/windows/process_creation/proc_creation_win_susp_jwt_token_search.yml","techniques":["T1528","T1552.001"],"cves":[]},{"id":"6ea858a8-ba71-4a12-b2cc-5d83312404c7","title":"HackTool - Typical HiveNightmare SAM File Export","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-07-23","modified":"2024-06-27","description":"Detects files written by the different tools that exploit HiveNightmare","references":["https://github.com/GossiTheDog/HiveNightmare","https://github.com/FireFart/hivenightmare/","https://github.com/WiredPulse/Invoke-HiveNightmare","https://twitter.com/cube0x0/status/1418920190759378944"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1552.001","cve.2021-36934"],"path":"rules/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml","techniques":["T1552.001"],"cves":["CVE-2021-36934"]},{"id":"76a26006-0942-430b-8249-bd51d448f8e5","title":"Unattend.XML File Access Attempt","author":"frack113","status":"test","level":"low","date":"2024-07-22","modified":null,"description":"Detects attempts to access the \"unattend.xml\" file, where credentials might be stored.\nThis file is used during the unattended windows install process.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.credential-access","attack.t1552.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_access/file_access_win_susp_unattend_xml.yml","techniques":["T1552.001"],"cves":[]},{"id":"80eeab92-0979-4152-942d-96749e11df40","title":"Azure Keyvault Key Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-16","modified":"2022-08-23","description":"Identifies when a Keyvault Key is modified or deleted in Azure.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1552","attack.t1552.001"],"path":"rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml","techniques":["T1552","T1552.001"],"cves":[]},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"b831353c-1971-477b-abb6-2828edc3bca1","title":"Azure Keyvault Secrets Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-16","modified":"2022-08-23","description":"Identifies when secrets are modified or deleted in Azure.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1552","attack.t1552.001"],"path":"rules/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml","techniques":["T1552","T1552.001"],"cves":[]},{"id":"b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee","title":"Potential Russian APT Credential Theft Activity","author":"Florian Roth (Nextron Systems)","status":"stable","level":"critical","date":"2019-02-21","modified":"2023-03-08","description":"Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike","references":["https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.001","attack.t1003.003","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Bear-APT-Activity/proc_creation_win_apt_bear_activity_gtr19.yml","techniques":["T1552.001","T1003.003"],"cves":[]},{"id":"bd5971a7-626d-46ab-8176-ed643f694f68","title":"Extracting Information with PowerShell","author":"frack113","status":"test","level":"medium","date":"2021-12-19","modified":"2022-12-25","description":"Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.\nThese can be files created by users to store their own credentials, shared credential stores for a group of individuals,\nconfiguration files containing passwords for a system or service, or source code/binary files containing embedded passwords.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1552.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_extracting.yml","techniques":["T1552.001"],"cves":[]},{"id":"cd072b25-a418-4f98-8ebc-5093fb38fe1a","title":"Cisco Collect Data","author":"Austin Clark","status":"test","level":"low","date":"2019-08-11","modified":"2023-01-04","description":"Collect pertinent data from the configuration files","references":["https://blog.router-switch.com/2013/11/show-running-config/","https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm","https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.discovery","attack.credential-access","attack.collection","attack.t1087.001","attack.t1552.001","attack.t1005"],"path":"rules/network/cisco/aaa/cisco_cli_collect_data.yml","techniques":["T1087.001","T1552.001","T1005"],"cves":[]},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"d7a650c4-226c-451e-948f-cc490db506aa","title":"PUA - TruffleHog Execution - Linux","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-09-24","modified":null,"description":"Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.\nWhile it is a legitimate tool, intended for use in CI pipelines and security assessments,\nIt was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.\n","references":["https://github.com/trufflesecurity/trufflehog","https://www.getsafety.com/blog-posts/shai-hulud-npm-attack"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.credential-access","attack.t1083","attack.t1552.001"],"path":"rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml","techniques":["T1083","T1552.001"],"cves":[]},{"id":"df3fcaea-2715-4214-99c5-0056ea59eb35","title":"Credentials In Files - Linux","author":"Igor Fits, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2023-04-30","description":"Detecting attempts to extract passwords with grep","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.credential-access","attack.t1552.001"],"path":"rules/linux/auditd/execve/lnx_auditd_find_cred_in_files.yml","techniques":["T1552.001"],"cves":[]},{"id":"f4ff7323-b5fc-4323-8b52-6b9408e15788","title":"Potential PowerShell Console History Access Attempt via History File","author":"Luc Génaux","status":"experimental","level":"medium","date":"2025-04-03","modified":null,"description":"Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).\nThis can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.\n","references":["https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_console_history_file_access.yml","techniques":["T1552.001"],"cves":[]},{"id":"f576a613-2392-4067-9d1a-9345fb58d8d1","title":"Automated Collection Command Prompt","author":"frack113","status":"test","level":"medium","date":"2021-07-28","modified":"2022-11-11","description":"Once established within a system or network, an adversary may use automated techniques for collecting internal data.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1119","attack.credential-access","attack.t1552.001"],"path":"rules/windows/process_creation/proc_creation_win_susp_automated_collection.yml","techniques":["T1119","T1552.001"],"cves":[]},{"id":"fa4aaed5-4fe0-498d-bbc0-08e3346387ba","title":"Copy Passwd Or Shadow From TMP Path","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"high","date":"2023-01-31","modified":null,"description":"Detects when the file \"passwd\" or \"shadow\" is copied from tmp path","references":["https://blogs.blackberry.com/","https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.001"],"path":"rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml","techniques":["T1552.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-57727","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-26138","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-11510","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}