Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/tech...
BY SOURCE
PROCEDURES (38)
Auto-extracted: 10 detections for process creation monitoring
Auto-extracted: 2 detections for azure
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for script execution monitoring
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for lateral
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for file monitoring
Auto-extracted: 1 detections for process access
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for kernel monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for download