Techniques › T1552
T1552 Unsecured Credentials
credential access — Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider · attack.mitre.org · JSON
1
MITRE detection strategy
7
analytics
13
Sigma rules tagged attack.t1552
4
KEV CVEs mapped here
<p>Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-20439 | Cisco Smart Licensing Utility | exploitation technique | Mapped | 2025-03-31 |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure | secondary impact | Mapped | 2024-01-10 |
| CVE-2023-49103 | ownCloud ownCloud graphapi | primary impact | Mapped | 2023-11-30 |
| CVE-2020-5902 | F5 BIG-IP | secondary impact | Stale | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0412 Detect Access or Search for Unsecured Credentials Across Platforms v1.0
AN1153 WindowsUnusual access to bash history, registry credentials paths, or private key files by unauthorized or scripting tools, with correlated file and process activity.Tunable:
TimeWindowSuspiciousProcessListAN1154 LinuxReading of sensitive files like .bash_history, /etc/shadow, or private key directories by unauthorized users or unusual processes.auditd:SYSCALLexecution of tools like cat, grep, or awk on credential files→ DC0064 Command ExecutionTunable:SensitivePathsUserContextAN1155 macOSUnusual access to ~/Library/Keychains, ~/.bash_history, or Terminal command history by unauthorized processes or users.macos:unifiedlogread access to ~/Library/Keychains or history files by terminal processes→ DC0055 File Accessmacos:unifiedlogexecution of 'security', 'cat', or 'grep' commands accessing credential storage→ DC0064 Command ExecutionTunable:ProcessNameTargetPathAN1156 SaaSUnusual web-based access or API scraping of password managers, single sign-on sessions, or credential sync services via browser automation or anomalous API tokens.saas:googleworkspaceAccessed third-party credential management service→ DC0002 User Account Authenticationsaas:zoomunusual web session tokens and automation patterns during login→ DC0038 Application Log ContentTunable:TokenAnomalyThresholdAccessGeoLocationAN1157 Identity ProviderUnauthorized API or console calls to retrieve or reset password credentials, download key material, or modify SSO settings.Tunable:SSOSettingScopeSecretTypeAN1158 ContainersAccess to container image layers or mounted secrets (e.g., Docker secrets) by processes not tied to entrypoint or orchestration context.auditd:SYSCALLread of /run/secrets or docker volumes by non-entrypoint process→ DC0055 File AccessTunable:EntrypointAllowlistVolumeMountPathAN1159 Network DevicesUse of configuration backup utilities or CLI access to dump plaintext passwords, local user hashes, or SNMP strings.linux:syslogCLI access to 'show running-config', 'show password', or 'cat config.txt'→ DC0064 Command ExecutionTunable:ManagementInterfaceIPsCommandPattern
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1552
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-02 · logsource: product=azure service=auditlogs · 1b45b0d1-773f-4f23-aedc-814b759563b1
Detects when a configuration change is made to an applications AppID URI.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 459a2970-bb84-4e6a-a32e-ff0fbd99448d
Identifies when a key vault is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=gcp service=gcp.audit · 6ad91e31-53df-4826-bd27-0166171c8040
Identifies when an admission controller is executed in GCP Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-02 · logsource: product=azure service=auditlogs · 74298991-9fc4-460e-a92e-511aa60baec1
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 80eeab92-0979-4152-942d-96749e11df40
Identifies when a Keyvault Key is modified or deleted in Azure.
Author: kelnage
· 2023-04-03 (modified 2026-04-27) · logsource: product=okta service=okta · 91b76b84-8589-47aa-9605-c837583b82a9
Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.
Author: Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
· 2023-11-20 (modified 2024-01-24) · logsource: product=windows category=process_creation · 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f
Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=azure service=activitylogs · a61a3c56-4ce2-4351-a079-88ae4cbd2b58
Identifies when an admission controller is executed in Azure Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · b831353c-1971-477b-abb6-2828edc3bca1
Identifies when secrets are modified or deleted in Azure.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2022-09-09 (modified 2025-12-02) · logsource: product=windows category=process_creation · beaa66d6-aa1b-4e3c-80f5-e0145369bfaf
Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs.
This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
Author: kelnage
· 2024-07-11 · logsource: product=kubernetes service=audit · eed82177-38f5-4299-8a76-098d50d225ab
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.