{"id":"T1552","name":"Unsecured Credentials","url":"https://attack.mitre.org/techniques/T1552","tactics":["credential-access"],"platforms":["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0412","stix_id":"x-mitre-detection-strategy--d1912fbc-aaac-4bb1-82f1-0713280ca9a1","name":"Detect Access or Search for Unsecured Credentials Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0412","analytics":[{"id":"AN1153","stix_id":"x-mitre-analytic--d76081f4-26cd-4e62-91e8-4e4a3992dd90","name":"Analytic 1153","description":"Unusual access to bash history, registry credentials paths, or private key files by unauthorized or scripting tools, with correlated file and process activity.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1153","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Defines the threshold time for accessing multiple sensitive files indicating automation."},{"field":"SuspiciousProcessList","description":"Process names to monitor (e.g., reg.exe, cmd.exe, powershell.exe, etc.)"}],"live":true,"detection_strategies":["DET0412"],"techniques":["T1552"]},{"id":"AN1154","stix_id":"x-mitre-analytic--27213df4-c761-4745-b8ef-f91a46966eb9","name":"Analytic 1154","description":"Reading of sensitive files like .bash_history, /etc/shadow, or private key directories by unauthorized users or unusual processes.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1154","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open/read system calls to ~/.bash_history or /etc/shadow","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execution of tools like cat, grep, or awk on credential files","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"SensitivePaths","description":"Paths to credential files such as /etc/shadow or ~/.bash_history"},{"field":"UserContext","description":"Whether the process runs under a privileged or non-interactive session"}],"live":true,"detection_strategies":["DET0412"],"techniques":["T1552"]},{"id":"AN1155","stix_id":"x-mitre-analytic--49897e8e-8d14-4fcb-b305-328d44e58f35","name":"Analytic 1155","description":"Unusual access to ~/Library/Keychains, ~/.bash_history, or Terminal command history by unauthorized processes or users.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1155","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"read access to ~/Library/Keychains or history files by terminal processes","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"execution of 'security', 'cat', or 'grep' commands accessing credential storage","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ProcessName","description":"Tool or command used to query credentials (e.g., security, grep)"},{"field":"TargetPath","description":"Credential file paths (e.g., ~/Library/Keychains)"}],"live":true,"detection_strategies":["DET0412"],"techniques":["T1552"]},{"id":"AN1156","stix_id":"x-mitre-analytic--0ec40b2f-4969-443f-bad5-4bc6239fec29","name":"Analytic 1156","description":"Unusual web-based access or API scraping of password managers, single sign-on sessions, or credential sync services via browser automation or anomalous API tokens.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1156","platforms":["SaaS"],"log_source_references":[{"name":"saas:googleworkspace","channel":"Accessed third-party credential management service","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"saas-googleworkspace"},{"name":"saas:zoom","channel":"unusual web session tokens and automation patterns during login","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-zoom"}],"mutable_elements":[{"field":"TokenAnomalyThreshold","description":"Scoring threshold for access token entropy, reuse, or bot-like patterns"},{"field":"AccessGeoLocation","description":"Region anomalies in SaaS portal access"}],"live":true,"detection_strategies":["DET0412"],"techniques":["T1552"]},{"id":"AN1157","stix_id":"x-mitre-analytic--3e30007c-fc51-447f-850a-c8378427be3d","name":"Analytic 1157","description":"Unauthorized API or console calls to retrieve or reset password credentials, download key material, or modify SSO settings.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1157","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:signinlogs","channel":"Reset password or download key from portal","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"azure-signinlogs"},{"name":"AWS:CloudTrail","channel":"GetSecretValue","data_component":"DC0070","data_component_name":"Cloud Service Metadata","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"SSOSettingScope","description":"Subset of IdP settings monitored for unauthorized changes"},{"field":"SecretType","description":"Which secrets (passwords, keys, tokens) are monitored"}],"live":true,"detection_strategies":["DET0412"],"techniques":["T1552"]},{"id":"AN1158","stix_id":"x-mitre-analytic--1a68a39c-c4e3-4ff1-88f5-db78575ce15e","name":"Analytic 1158","description":"Access to container image layers or mounted secrets (e.g., Docker secrets) by processes not tied to entrypoint or orchestration context.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1158","platforms":["Containers"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"read of /run/secrets or docker volumes by non-entrypoint process","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"containerd:Events","channel":"unusual process spawned from container image context","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"containerd-events"}],"mutable_elements":[{"field":"EntrypointAllowlist","description":"Container entrypoints that are permitted to read secrets"},{"field":"VolumeMountPath","description":"Paths to credentials/secrets inside container images"}],"live":true,"detection_strategies":["DET0412"],"techniques":["T1552"]},{"id":"AN1159","stix_id":"x-mitre-analytic--badcc199-683b-41f5-9522-9710969cff15","name":"Analytic 1159","description":"Use of configuration backup utilities or CLI access to dump plaintext passwords, local user hashes, or SNMP strings.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1159","platforms":["Network Devices"],"log_source_references":[{"name":"linux:syslog","channel":"CLI access to 'show running-config', 'show password', or 'cat config.txt'","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-syslog"},{"name":"NSM:Flow","channel":"large transfer from management IPs to unauthorized host","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ManagementInterfaceIPs","description":"IP ranges authorized to perform credential dumps"},{"field":"CommandPattern","description":"Regex patterns for suspicious CLI commands"}],"live":true,"detection_strategies":["DET0412"],"techniques":["T1552"]}],"live":true,"version":"1.0","techniques":["T1552"]}],"sigma_rules":[{"id":"0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6","title":"Script Interpreter Spawning Credential Scanner - Windows","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).\nThis behavior is indicative of an attempt to find and steal secrets, as seen in the \"Shai-Hulud: The Second Coming\" campaign.\n","references":["https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js","https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised","https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime","https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552","attack.collection","attack.execution","attack.t1005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner.yml","techniques":["T1552","T1005","T1059.007"],"cves":[]},{"id":"1b45b0d1-773f-4f23-aedc-814b759563b1","title":"Application AppID Uri Configuration Changes","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","status":"test","level":"high","date":"2022-06-02","modified":null,"description":"Detects when a configuration change is made to an applications AppID URI.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.initial-access","attack.persistence","attack.credential-access","attack.privilege-escalation","attack.stealth","attack.t1552","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml","techniques":["T1552","T1078.004"],"cves":[]},{"id":"459a2970-bb84-4e6a-a32e-ff0fbd99448d","title":"Azure Key Vault Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-16","modified":"2022-08-23","description":"Identifies when a key vault is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1552","attack.t1552.001"],"path":"rules/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml","techniques":["T1552","T1552.001"],"cves":[]},{"id":"6ad91e31-53df-4826-bd27-0166171c8040","title":"Google Cloud Kubernetes Admission Controller","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-11-25","modified":"2022-12-18","description":"Identifies when an admission controller is executed in GCP Kubernetes.\nA Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\nThe behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\nAn adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\nFor example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\nAn adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\n","references":["https://cloud.google.com/kubernetes-engine/docs"],"logsource":{"product":"gcp","service":"gcp.audit"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.credential-access","attack.t1552","attack.t1552.007"],"path":"rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml","techniques":["T1078","T1552","T1552.007"],"cves":[]},{"id":"74298991-9fc4-460e-a92e-511aa60baec1","title":"Added Owner To Application","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","status":"test","level":"medium","date":"2022-06-02","modified":null,"description":"Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.t1552","attack.credential-access"],"path":"rules/cloud/azure/audit_logs/azure_app_owner_added.yml","techniques":["T1552"],"cves":[]},{"id":"80eeab92-0979-4152-942d-96749e11df40","title":"Azure Keyvault Key Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-16","modified":"2022-08-23","description":"Identifies when a Keyvault Key is modified or deleted in Azure.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1552","attack.t1552.001"],"path":"rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml","techniques":["T1552","T1552.001"],"cves":[]},{"id":"91b76b84-8589-47aa-9605-c837583b82a9","title":"Potential Okta Password in AlternateID Field","author":"kelnage","status":"test","level":"high","date":"2023-04-03","modified":"2026-04-27","description":"Detects when a user has potentially entered their password into the\nusername field, which will cause the password to be retained in log files.\n","references":["https://developer.okta.com/docs/reference/api/system-log/","https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data","https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm"],"logsource":{"product":"okta","service":"okta"},"tags":["attack.credential-access","attack.t1552"],"path":"rules/identity/okta/okta_password_in_alternateid_field.yml","techniques":["T1552"],"cves":[]},{"id":"9cd55b6c-430a-4fa9-96f4-7cadf5229e9f","title":"EventLog Query Requests By Builtin Utilities","author":"Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-11-20","modified":"2024-01-24","description":"Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.\n","references":["https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1","http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.t1552","attack.credential-access","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_susp_event_log_query.yml","techniques":["T1552"],"cves":[]},{"id":"a61a3c56-4ce2-4351-a079-88ae4cbd2b58","title":"Azure Kubernetes Admission Controller","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-11-25","modified":"2022-12-18","description":"Identifies when an admission controller is executed in Azure Kubernetes.\nA Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\nThe behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\nAn adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\nFor example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.\nAn adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\nAn adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\n","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.credential-access","attack.t1552","attack.t1552.007"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml","techniques":["T1078","T1552","T1552.007"],"cves":[]},{"id":"b831353c-1971-477b-abb6-2828edc3bca1","title":"Azure Keyvault Secrets Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-16","modified":"2022-08-23","description":"Identifies when secrets are modified or deleted in Azure.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1552","attack.t1552.001"],"path":"rules/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml","techniques":["T1552","T1552.001"],"cves":[]},{"id":"beaa66d6-aa1b-4e3c-80f5-e0145369bfaf","title":"Potentially Suspicious EventLog Recon Activity Using Log Query Utilities","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2022-09-09","modified":"2025-12-02","description":"Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs.\nThis technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.\n","references":["http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html","https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a","https://www.group-ib.com/blog/apt41-world-tour-2021/","https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1","http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil","https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today","https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/","https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.discovery","attack.t1552","attack.t1087"],"path":"rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml","techniques":["T1552","T1087"],"cves":[]},{"id":"eed82177-38f5-4299-8a76-098d50d225ab","title":"Kubernetes Admission Controller Modification","author":"kelnage","status":"test","level":"medium","date":"2024-07-11","modified":null,"description":"Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.\n","references":["https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/","https://security.padok.fr/en/blog/kubernetes-webhook-attackers"],"logsource":{"product":"kubernetes","service":"audit"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.credential-access","attack.t1552","attack.t1552.007"],"path":"rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml","techniques":["T1078","T1552","T1552.007"],"cves":[]},{"id":"f0025a69-e1b7-4dda-a53c-db21fa2d4071","title":"Script Interpreter Spawning Credential Scanner - Linux","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).\nThis behavior is indicative of an attempt to find and steal secrets, as seen in the \"Shai-Hulud: The Second Coming\" campaign.\n","references":["https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js","https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised","https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime","https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.credential-access","attack.t1552","attack.execution","attack.collection","attack.t1005","attack.t1059.004"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_script_interpretor_spawn_credential_scanner.yml","techniques":["T1552","T1005","T1059.004"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-20439","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-21887","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-49103","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-5902","state":"stale","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}