tfMITRE ATT&CK technique

Unsecured Credentials T1552

Tactic: Credential Access
Platforms: Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider
Version: 1.5
Created: 04 February 2020
Last modified: 24 October 2025
Contributor: Austin Clark, @c2defense

Sub-techniques 889 rules across the family · 22 mapped directly to T1552 · 7 of 8 carry rules

.001Credentials In Files31 .002Credentials in Registry8 .003Shell History4 .004Private Keys13 .005Cloud Instance Metadata API1 .006Group Policy Preferences8 .007Container API8 .008Chat Messages0

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 12%

Detection rules88th percentile · 88% of ATT&CK techniques have this many detection rules written or fewer.

Unsecured Credentials MITRE reference T1552

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Volt TyphoonG1017 ↗

Has obtained credentials insecurely stored on targeted network appliances.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

All 1 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

NPPSPYS1131 ↗

Captures credentials by recording them through an alternative network listener registered to the mpnotify.exe process, allowing for cleartext recording of logon information.1

created 2024-05-17TOOL

DarkGateS1111 ↗

Uses NirSoft tools to steal user credentials from the infected machine.1 NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.

created 2024-02-09MALWARE

PacuS1091 ↗

Can search for sensitive data: for example, in Code Build environment variables, EC2 user data, and Cloud Formation templates.1

created 2023-09-28TOOL

AstarothS0373 ↗

Uses an external software known as NetPass to recover passwords. 1

created 2019-04-17MALWARE

All 4 software entries for this technique

Offense vs defense T1552

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 13Splunk ESCU (cumulative) · 9

first rule: 2020 Q4 · 1 of 1 campaigns plotted

Unsecured Credentials detection strategy DET0412

MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Access or Search for Unsecured Credentials Across Platforms

Enterprise

7 platforms

AN1153 · Windows

Unusual access to bash history, registry credentials paths, or private key files by unauthorized or scripting tools, with correlated file and process activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines the threshold time for accessing multiple sensitive files indicating automation.
SuspiciousProcessList	Process names to monitor (e.g., reg.exe, cmd.exe, powershell.exe, etc.)

AN1154 · Linux

Reading of sensitive files like .bash_history, /etc/shadow, or private key directories by unauthorized users or unusual processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	auditd:SYSCALL	open/read system calls to ~/.bash_history or /etc/shadow
Command ExecutionDC0064	auditd:SYSCALL	execution of tools like cat, grep, or awk on credential files

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SensitivePaths	Paths to credential files such as /etc/shadow or ~/.bash_history
UserContext	Whether the process runs under a privileged or non-interactive session

AN1155 · macOS

Unusual access to ~/Library/Keychains, ~/.bash_history, or Terminal command history by unauthorized processes or users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	macos:unifiedlog	read access to ~/Library/Keychains or history files by terminal processes
Command ExecutionDC0064	macos:unifiedlog	execution of 'security', 'cat', or 'grep' commands accessing credential storage

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessName	Tool or command used to query credentials (e.g., security, grep)
TargetPath	Credential file paths (e.g., ~/Library/Keychains)

AN1156 · SaaS

Unusual web-based access or API scraping of password managers, single sign-on sessions, or credential sync services via browser automation or anomalous API tokens.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	saas:googleworkspace	Accessed third-party credential management service
Application Log ContentDC0038	saas:zoom	unusual web session tokens and automation patterns during login

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TokenAnomalyThreshold	Scoring threshold for access token entropy, reuse, or bot-like patterns
AccessGeoLocation	Region anomalies in SaaS portal access

AN1157 · Identity Provider

Unauthorized API or console calls to retrieve or reset password credentials, download key material, or modify SSO settings.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	azure:signinlogs	Reset password or download key from portal
Cloud Service MetadataDC0070	AWS:CloudTrail	GetSecretValue

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SSOSettingScope	Subset of IdP settings monitored for unauthorized changes
SecretType	Which secrets (passwords, keys, tokens) are monitored

AN1158 · Containers

Access to container image layers or mounted secrets (e.g., Docker secrets) by processes not tied to entrypoint or orchestration context.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	containerd:Events	unusual process spawned from container image context
File AccessDC0055	auditd:SYSCALL	read of /run/secrets or docker volumes by non-entrypoint process

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EntrypointAllowlist	Container entrypoints that are permitted to read secrets
VolumeMountPath	Paths to credentials/secrets inside container images

AN1159 · Network Devices

Use of configuration backup utilities or CLI access to dump plaintext passwords, local user hashes, or SNMP strings.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	linux:syslog	CLI access to 'show running-config', 'show password', or 'cat config.txt'
Network Traffic ContentDC0085	NSM:Flow	large transfer from management IPs to unauthorized host

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ManagementInterfaceIPs	IP ranges authorized to perform credential dumps
CommandPattern	Regex patterns for suspicious CLI commands

Active Directory ConfigurationM1015

Remove vulnerable Group Policy Preferences.

AuditM1047

Preemptively search for files containing passwords or other credentials and take actions to reduce the exposure risk when found.

Encrypt Sensitive InformationM1041

When possible, store keys on separate cryptographic hardware instead of on the local system.

Filter Network TrafficM1037

Limit access to the Instance Metadata API. A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.

Limit Access to Resource Over NetworkM1035

Limit network access to sensitive services, such as the Instance Metadata API.

Operating System ConfigurationM1028

There are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands: set +o history and set -o history to start logging again; unset HISTFILE being added to a user's .bash_rc file; and ln -s /dev/null ~/.bash_history to write commands to /dev/nullinstead.

Password PoliciesM1027

Use strong passphrases for private keys to make cracking difficult. Do not store credentials within the Registry. Establish an organizational policy that prohibits password storage in files.

Privileged Account ManagementM1026

If it is necessary that software must store credentials in the Registry, then ensure the associated accounts have limited permissions so they cannot be abused if obtained by an adversary.

Restrict File and Directory PermissionsM1022

Restrict file shares to specific directories with access only to necessary users.

Update SoftwareM1051

Apply patch KB2962486 which prevents credentials from being stored in GPPs.

User TrainingM1017

Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.

Tests2Executorssh 1 · PowerShell 1Need elevation1 of 2Have prerequisites1Have cleanup1Platformslinux, macos, iaas:aws, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

AWS - Retrieve EC2 Password Data using stratus

linux, macos, iaas:aws

—

Yes

This atomic runs an API call GetPasswordData from a role that does not have permission to do so. This simulates an attacker attempting to retrieve RDP passwords on a high number of Windows EC2 instances. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/

Input arguments

Name	Type	Default	Description
aws_region	string	us-west-2	AWS region to detonate
stratus_path	path	$PathToAtomicsFolder/T1552/src	Path of stratus binary

Attack command

export AWS_REGION=#{aws_region} 
cd #{stratus_path}
echo "starting warmup"
./stratus warmup aws.credential-access.ec2-get-password-data
echo "starting detonate"
./stratus detonate aws.credential-access.ec2-get-password-data --force

Cleanup command

export AWS_REGION=#{aws_region}
echo "Cleanup detonation"
cd #{stratus_path}
./stratus cleanup --all
rm -rf stratus*

Prerequisite

Stratus binary must be present at the (#{stratus_path}/stratus)

Check

if [ -f #{stratus_path}/stratus ]; then exit 0; else exit 1; fi;

Satisfy

if [ "$(uname)" == "Darwin" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep Darwin_x86_64 | cut -d '"' -f 4); wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
elif [ "$(expr substr $(uname) 1 5)" == "Linux" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep Linux_x86_64 | cut -d '"' -f 4) 
  wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
fi

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo Please install the aws-cli and configure your AWS defult profile using: aws configure

GUIDce5e4136-aeec-43b5-a133-5fd4753e5b3c

Search for Passwords in Powershell History

windows

PowerShell

Required

—

Tests from Atomic Red Team (MIT licence) · technique definition

Unsecured Credentials detections T1552

22 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 12%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs