Techniques › T1552 › T1552.001
T1552.001 Credentials In Files
credential access — Containers, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
24
Sigma rules tagged attack.t1552.001
3
KEV CVEs mapped here
<p>Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.</p><p>It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.</p><p>In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files. They may also be found as parameters to deployment commands in container logs. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-57727 | SimpleHelp SimpleHelp | primary impact | Mapped | 2025-02-13 |
| CVE-2022-26138 | Atlassian Confluence | exploitation technique | Mapped | 2022-07-29 |
| CVE-2019-11510 | Ivanti Pulse Connect Secure | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0307 Detect Access to Unsecured Credential Files Across Platforms v1.0
AN0856 WindowsCorrelated file access to insecure credential files (e.g., .env, .xml, *.ps1) followed by suspicious process execution or authentication using retrieved credentials. Detected through Sysmon logs and Windows Security Event logs.Tunable:
FileNamePatternProcessAccessScopeTimeWindowAN0857 LinuxFile reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.Tunable:RegexPatternsUserContextScopeTimeWindowAN0858 macOSTerminal-based grep or open of plist/config files containing credentials, correlated with Keychain or system login attempts.Tunable:KeychainToolAccessFileTypeListAN0859 ContainersContainer processes accessing mounted secrets or configuration paths (e.g., /run/secrets, /mnt/config) followed by network access or credential use.kubernetes:auditprocess execution involving curl, grep, or awk on secrets→ DC0064 Command ExecutionTunable:SecretMountPathsProcessBaselineDeviationAN0860 IaaSAccess to local credential/config files (e.g., ~/.aws/credentials) followed by metadata API calls or cloud role assumptions.CloudTrail:GetObjectsensitive credential files in buckets or local image storage→ DC0055 File AccessTunable:CredentialFilePatternRoleAssumptionScopeTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1552.001
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 (modified 2026-01-24) · logsource: product=linux category=file_event · 0aba5685-6db6-486f-88ef-29a99c545cfd
Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets
Author: Florian Roth (Nextron Systems)
· 2022-06-20 · logsource: product=linux category=process_creation · 0cf7a157-8879-41a2-8f55-388dd23746b7
Detects events with patterns found in commands used for reconnaissance on linux systems
Author: Josh Nickels
· 2023-05-18 · logsource: product=windows category=process_creation · 1a0f6f16-2099-4753-9a02-43b6ac7a1fa5
Detects command line usage of "findstr" to search for the "passwords" keyword in a variety of different languages
Author: Omar Khaled (@beacon_exe)
· 2024-08-21 · logsource: product=macos category=process_creation · 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=windows category=process_creation · 44030449-b0df-4c94-aae1-502359ab28ee
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 459a2970-bb84-4e6a-a32e-ff0fbd99448d
Identifies when a key vault is modified or deleted.
Author: Igor Fits, Mikhail Larin, oscd.community
· 2020-10-19 (modified 2021-11-27) · logsource: product=macos category=process_creation · 53b1b378-9b06-4992-b972-dde6e423d2b4
Detecting attempts to extract passwords with grep and laZagne
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 587254ee-a24b-4335-b3cd-065c0f1f4baa
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Author: Nasreddine Bencherchali (Nextron Systems), kagebunsher
· 2022-10-25 (modified 2025-10-21) · logsource: product=windows category=process_creation · 6d3a3952-6530-44a3-8554-cf17c116c615
Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG".
JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
Author: Florian Roth (Nextron Systems)
· 2021-07-23 (modified 2024-06-27) · logsource: product=windows category=file_event · 6ea858a8-ba71-4a12-b2cc-5d83312404c7
Detects files written by the different tools that exploit HiveNightmare
Author: frack113
· 2024-07-22 · logsource: product=windows category=file_access · 76a26006-0942-430b-8249-bd51d448f8e5
Detects attempts to access the "unattend.xml" file, where credentials might be stored.
This file is used during the unattended windows install process.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 80eeab92-0979-4152-942d-96749e11df40
Identifies when a Keyvault Key is modified or deleted in Azure.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · b831353c-1971-477b-abb6-2828edc3bca1
Identifies when secrets are modified or deleted in Azure.
Author: Florian Roth (Nextron Systems)
· 2019-02-21 (modified 2023-03-08) · logsource: product=windows category=process_creation · b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee
Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike
Author: frack113
· 2021-12-19 (modified 2022-12-25) · logsource: product=windows category=ps_script · bd5971a7-626d-46ab-8176-ed643f694f68
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Author: Austin Clark
· 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · cd072b25-a418-4f98-8ebc-5093fb38fe1a
Collect pertinent data from the configuration files
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · d7a650c4-226c-451e-948f-cc490db506aa
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Author: Igor Fits, oscd.community
· 2020-10-15 (modified 2023-04-30) · logsource: product=linux service=auditd · df3fcaea-2715-4214-99c5-0056ea59eb35
Detecting attempts to extract passwords with grep
Author: Luc Génaux
· 2025-04-03 · logsource: product=windows category=process_creation · f4ff7323-b5fc-4323-8b52-6b9408e15788
Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).
This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.
Author: frack113
· 2021-07-28 (modified 2022-11-11) · logsource: product=windows category=process_creation · f576a613-2392-4067-9d1a-9345fb58d8d1
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-01-31 · logsource: product=linux category=process_creation · fa4aaed5-4fe0-498d-bbc0-08e3346387ba
Detects when the file "passwd" or "shadow" is copied from tmp path
Rules tagged at the parent level (attack.t1552) 13
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-02 · logsource: product=azure service=auditlogs · 1b45b0d1-773f-4f23-aedc-814b759563b1
Detects when a configuration change is made to an applications AppID URI.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 459a2970-bb84-4e6a-a32e-ff0fbd99448d
Identifies when a key vault is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=gcp service=gcp.audit · 6ad91e31-53df-4826-bd27-0166171c8040
Identifies when an admission controller is executed in GCP Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-02 · logsource: product=azure service=auditlogs · 74298991-9fc4-460e-a92e-511aa60baec1
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 80eeab92-0979-4152-942d-96749e11df40
Identifies when a Keyvault Key is modified or deleted in Azure.
Author: kelnage
· 2023-04-03 (modified 2026-04-27) · logsource: product=okta service=okta · 91b76b84-8589-47aa-9605-c837583b82a9
Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.
Author: Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
· 2023-11-20 (modified 2024-01-24) · logsource: product=windows category=process_creation · 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f
Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=azure service=activitylogs · a61a3c56-4ce2-4351-a079-88ae4cbd2b58
Identifies when an admission controller is executed in Azure Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · b831353c-1971-477b-abb6-2828edc3bca1
Identifies when secrets are modified or deleted in Azure.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2022-09-09 (modified 2025-12-02) · logsource: product=windows category=process_creation · beaa66d6-aa1b-4e3c-80f5-e0145369bfaf
Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs.
This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
Author: kelnage
· 2024-07-11 · logsource: product=kubernetes service=audit · eed82177-38f5-4299-8a76-098d50d225ab
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.