Unsecured Credentials
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/...
BY SOURCE
PROCEDURES (66)
Auto-extracted: 5 detections for azure
Auto-extracted: 4 detections for aws
Auto-extracted: 4 detections for anomal
Auto-extracted: 3 detections for credential
Auto-extracted: 3 detections for registry
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for http
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for dump
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for oauth
Auto-extracted: 2 detections for event log
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for impersonat
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for impersonat
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for process access
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for cloud monitoring