ShinyHuntersG1057 ↗
Has gathered PII from database infrastructure.1
tfMITRE ATT&CK sub-technique
Credentials In Files T1552.001
sub-technique of T1552 Unsecured Credentials
- Tactic
- Credential Access
- Platforms
- Containers, IaaS, Linux, macOS, Windows
- Version
- 1.3
- Created
- 04 February 2020
- Last modified
- 12 May 2026
- Contributors
- Rory McCune, Aqua Security; Jay Chen, Palo Alto Networks; Yossi Weizman, Azure Defender Research Team; Vishwas Manral, McAfee; Microsoft Threat Intelligence Center (MSTIC)
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
15
Threat groupsTop 12%
Threat groups88th percentile · 88% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.23
Tools & malwareTop 15%
Tools & malware85th percentile · 85% of ATT&CK techniques have this many tools implementing them or fewer.31
Detection rulesTop 8%
Detection rules92nd percentile · 92% of ATT&CK techniques have this many detection rules written or fewer.Credentials In Files MITRE reference T1552.001
Top 12%of all ATT&CK techniques for number of groups
15 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
RedCurlG1039 ↗
FIN13G1016 ↗
Has obtained administrative credentials by browsing through local files on a compromised machine.1
Scattered SpiderG1015 ↗
Spider searches for credential storage documentation on a compromised host.123
Ember BearG1003 ↗
Has dumped configuration settings in accessed IP cameras including plaintext credentials.1
TeamTNTG0139 ↗
Has searched for unsecured AWS credentials and Docker API credentials.123
All 15 groups for this technique · 6 newest in this preview
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Anthropic AI-orchestrated CampaignC0062 ↗
During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to extract authentication certificates stored in system configuration files across compromised environments.1
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors accessed web.config and machine.config to extract MachineKey values, enabling them to forge legitimate VIEWSTATE tokens for future deserialization payloads.12345
Leviathan Australian IntrusionsC0049 ↗
Leviathan gathered credentials stored in files related to Building Management System (BMS) operations during Leviathan Australian Intrusions.1
All 3 campaigns for this technique
23 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Has searched compromised mailboxes for credential material such as seed phrases and API keys.1
Mini Shai-HuludS9043 ↗
Has collected credentials stored within configuration files.12 Mini Shai-Hulud has also gathered credentials from files stored in common credential file paths to include targeting git-credentials, azureProfile.json, and application_default_credentials.json.34
TeamPCP Cloud StealerS9041 ↗
Has the ability to check over 50 file paths for credentials stored in files across CI/CD, cloud, container, and other environments.123456
TruffleHogS9009 ↗
Has obtained credentials stored in config files and credential files in victim environments.12
Shai-HuludS9008 ↗
Has gathered sensitive data stored in the Node.JS file process.env to include credentials and API keys.123 Shai-Hulud has harvested credentials stored in config files and credential files in victim environments to include ~/.aws/credentials, application_default_credentials.json, and azureProfile.json.4523 Shai-Hulud has also targeted credentials and tokens stored in NPM files .npmrc and GitHub config files.4523
StrelaStealerS1183 ↗
Searches for and if found collects the contents of files such as logins.json and key4.db in the $APPDATA%\Thunderbird\Profiles\ directory, associated with the Thunderbird email application.12
All 23 software entries for this technique · 6 newest in this preview
Offense vs defense T1552.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 3Sigma rules (cumulative) · 24Splunk ESCU (cumulative) · 7
first rule: 2019 Q1 · 3 of 3 campaigns plottedCredentials In Files detection strategy DET0307
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Access to Unsecured Credential Files Across Platforms
5 platforms
AN0856 · Windows
Correlated file access to insecure credential files (e.g., *.env, *.xml, *.ps1) followed by suspicious process execution or authentication using retrieved credentials. Detected through Sysmon logs and Windows Security Event logs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FileNamePattern | Patterns like *.env, *credential* can be tuned to reduce noise or catch custom implementations |
| ProcessAccessScope | Defines scope of access (e.g., only untrusted parent processes or high-risk processes) |
| TimeWindow | Time delta between credential file access and use in logon attempt |
AN0857 · Linux
File reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | auditd:SYSCALL | open/read of sensitive config or secret files |
| Command ExecutionDC0064 | auditd:EXECVE | grep/cat/awk on files with password fields |
| Logon Session CreationDC0067 | linux:syslog | authentication success after file access |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RegexPatterns | Patterns like password, secret, token can be expanded or customized |
| UserContextScope | Scope of users monitored (e.g., root vs all users) |
| TimeWindow | Time between suspicious file access and credential use |
AN0858 · macOS
Terminal-based grep or open of plist/config files containing credentials, correlated with Keychain or system login attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | macos:unifiedlog | open/read of *.plist or .env files |
| Command ExecutionDC0064 | macos:unifiedlog | grep/cat on files matching credential patterns |
| Logon Session CreationDC0067 | macos:unifiedlog | Keychain or user login post-access |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| KeychainToolAccess | Monitor unexpected use of security CLI or Keychain helper binaries |
| FileTypeList | Add or remove watched file types based on system usage |
AN0859 · Containers
Container processes accessing mounted secrets or configuration paths (e.g., /run/secrets, /mnt/config) followed by network access or credential use.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | ebpf:syscalls | open/read on secret mount paths |
| Command ExecutionDC0064 | kubernetes:audit | process execution involving curl, grep, or awk on secrets |
| Network Connection CreationDC0082 | cni:netflow | outbound connection to internal or external APIs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SecretMountPaths | Customize based on deployment structure (e.g., /mnt/, /run/secrets/) |
| ProcessBaselineDeviation | Tune anomaly scoring for container image deviations |
AN0860 · IaaS
Access to local credential/config files (e.g., ~/.aws/credentials) followed by metadata API calls or cloud role assumptions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | CloudTrail:GetObject | sensitive credential files in buckets or local image storage |
| Command ExecutionDC0064 | AWS:CloudTrail | command-line execution invoking credential enumeration |
| Logon Session CreationDC0067 | AWS:CloudTrail | sudden role assumption after credential file access |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CredentialFilePattern | Regex to match common credential files (e.g., *.aws/credentials, token.txt) |
| RoleAssumptionScope | Adjust scope of roles monitored (e.g., admin, service accounts) |
| TimeWindow | Correlation timing between file access and AssumeRole |
1 analytic
Adversaries may search the Windows Registry on compromised systems for insecurely stored credentials for credential access. This can be accomplished using the query functionality of the reg.exe system utility, by looking for keys and values that contain strings such as "password". In addition, adversaries may use toolkits such as PowerSploit in order to dump credentials from various applications such as IIS.Accordingly, this analytic looks for invocations of reg.exe in this capacity as well as that of several powersploit modules with similar functionality.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
processes = search Process:Create cred_processes = filter processes where ( command_line = "*reg* query HKLM /f password /t REG_SZ /s*" OR command_line = "reg* query HKCU /f password /t REG_SZ /s" OR command_line = "*Get-UnattendedInstallFile*" OR command_line = "*Get-Webconfig*" OR command_line = "*Get-ApplicationHost*" OR command_line = "*Get-SiteListPassword*" OR command_line = "*Get-CachedGPPPassword*" OR command_line = "*Get-RegistryAutoLogon*") output cred_processes
This Splunk search looks for command lines of reg.exe used to search for passwords, as well as those of powersploit modules for the same purpose.
((index=__your_sysmon_index__ EventCode=1) OR (index=__your_win_syslog_index__ EventCode=4688)) (CommandLine="*reg* query HKLM /f password /t REG_SZ /s*" OR CommandLine="reg* query HKCU /f password /t REG_SZ /s" OR CommandLine="*Get-UnattendedInstallFile*" OR CommandLine="*Get-Webconfig*" OR CommandLine="*Get-ApplicationHost*" OR CommandLine="*Get-SiteListPassword*" OR CommandLine="*Get-CachedGPPPassword*" OR CommandLine="*Get-RegistryAutoLogon*")
This LogPoint search looks for command lines of reg.exe used to search for passwords, as well as those of powersploit modules for the same purpose.
norm_id=WindowsSysmon event_id=1 command IN ["*reg* query HKLM /f password /t REG_SZ /s*", "reg* query HKCU /f password /t REG_SZ /s", "*Get-UnattendedInstallFile*", "*Get-Webconfig*", "*Get-ApplicationHost*", "*Get-SiteListPassword*", "*Get-CachedGPPPassword*", "*Get-RegistryAutoLogon*"]
AuditM1047
Preemptively search for files containing passwords and take actions to reduce the exposure risk when found.
Password PoliciesM1027
Establish an organizational policy that prohibits password storage in files.
Restrict file shares to specific directories with access only to necessary users.
User TrainingM1017
Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.
Tests17ExecutorsPowerShell 8 · sh 5 · bash 2 · cmd 2Need elevation4 of 17Have prerequisites0Have cleanup1Platformsmacos, linux, windows
Tests from Atomic Red Team (MIT licence) · technique definition