T1552.001: Credentials In Files
| View on MITRE ATT&CK | T1552.001 |
|---|---|
| Tactic(s) | Credential Access |
| Associated CAPEC Patterns | Probe System Files (CAPEC-639) , Read Sensitive Constants Within an Executable (CAPEC-191) |
Data from MITRE ATT&CK®:
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)
In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)
© 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Cyber Threat Graph Context
Explore how this ATT&CK Technique relates to the wider threat graph
Reporting on this Technique
Scattered Spider Advisory AA23-320A
This advisory from CISA outlines tactics, techniques and procedures used by the Scattered Spider threat actors, as observed by the FBI up until ...
APT40 Advisory - PRC MSS tradecraft in action
This advisory, authored by the Australian Cyber Security Centre and multiple other international cybersecurity agencies, outlines the threat posed ...
From OneNote to RansomNote: An Ice Cold Intrusion
This case report from The DFIR Report describes an intrusion which started with a malicious OneNote attachment. Opening the OneNote file led to ...
REDCURL - The pentest you didn't know about
This report by researchers at Group-IB outlines activity by a group they call RedCurl. The report identifies victimology and motivation (corporate ...
Mitigations for this technique
MITRE ATT&CK Mitigations
Password Policies
Set and enforce secure password policies for accounts.User Training
Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.Audit
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.Restrict File and Directory Permissions
Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.How to detect this technique
MITRE ATT&CK Data Components
File Access (File)
Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)Command Execution (Command)
The execution of a line of text, potentially with arguments, created from program code (e.g. a cmdlet executed via powershell.exe, interactive commands like >dir, shell executions, etc. )Process Creation (Process)
The initial construction of an executable managed by the OS, that may involve one or more tasks or threads. (e.g. Win EID 4688, Sysmon EID 1, cmd.exe > net use, etc.)Control Validation Tests for this Technique
Use Atomic Red Team tests to test your defenses against this technique.
Extract Browser and System credentials with LaZagne
Extracting passwords with findstr
Find and Access Github Credentials
WinPwn - Snaffler
WinPwn - SessionGopher
Access unattend.xml
WinPwn - Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials
Find AWS credentials
WinPwn - powershellsensitive
Extract passwords with grep
WinPwn - passhunt
WinPwn - sensitivefiles
Sigma Detections for this Technique
Suspicious Unattend.xml File Access
Azure Keyvault Secrets Modified or Deleted
Linux Recon Indicators
Typical HiveNightmare SAM File Export
Suspicious Active Directory Database Snapshot Via ADExplorer
Insensitive Subfolder Search Via Findstr.EXE
Automated Collection Command Prompt
Cisco Collect Data
Active Directory Database Snapshot Via ADExplorer
Extracting Information with PowerShell
HackTool - WinPwn Execution - ScriptBlock
HackTool - WinPwn Execution
Azure Keyvault Key Modified or Deleted
Azure Key Vault Modified or Deleted
Copy Passwd Or Shadow From TMP Path
Credentials In Files
Credentials In Files - Linux
Remote File Download Via Findstr.EXE
SP800-53 Controls
See which controls can help protect against this MITRE ATT&CK technique. This is based on mappings to associated SP800-53 controls produced by the MITRE Engenuity Center for Threat-Informed Defense.