EXPLORE
← Back to Explore
T1552.001

Credentials In Files

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/tech...

ContainersIaaSLinuxmacOSWindows
53
Detections
3
Sources
14
Threat Actors

BY SOURCE

27elastic20sigma6splunk_escu

PROCEDURES (38)

Process Creation Monitoring10 detections

Auto-extracted: 10 detections for process creation monitoring

Azure2 detections

Auto-extracted: 2 detections for azure

General Monitoring2 detections

Auto-extracted: 2 detections for general monitoring

Script Execution Monitoring2 detections

Auto-extracted: 2 detections for script execution monitoring

Container2 detections

Auto-extracted: 2 detections for container

Api2 detections

Auto-extracted: 2 detections for api

Lateral2 detections

Auto-extracted: 2 detections for lateral

Persist1 detections

Auto-extracted: 1 detections for persist

File Monitoring1 detections

Auto-extracted: 1 detections for file monitoring

Process Access1 detections

Auto-extracted: 1 detections for process access

Credential1 detections

Auto-extracted: 1 detections for credential

Api1 detections

Auto-extracted: 1 detections for api

Dump1 detections

Auto-extracted: 1 detections for dump

Token1 detections

Auto-extracted: 1 detections for token

Kerbero1 detections

Auto-extracted: 1 detections for kerbero

Credential1 detections

Auto-extracted: 1 detections for credential

Authentication Monitoring1 detections

Auto-extracted: 1 detections for authentication monitoring

Privilege1 detections

Auto-extracted: 1 detections for privilege

Privilege1 detections

Auto-extracted: 1 detections for privilege

Remote1 detections

Auto-extracted: 1 detections for remote

Container1 detections

Auto-extracted: 1 detections for container

Credential1 detections

Auto-extracted: 1 detections for credential

Container1 detections

Auto-extracted: 1 detections for container

Azure1 detections

Auto-extracted: 1 detections for azure

Persist1 detections

Auto-extracted: 1 detections for persist

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Kernel Monitoring1 detections

Auto-extracted: 1 detections for kernel monitoring

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Event Log1 detections

Auto-extracted: 1 detections for event log

Event Log1 detections

Auto-extracted: 1 detections for event log

Kerbero1 detections

Auto-extracted: 1 detections for kerbero

Dump1 detections

Auto-extracted: 1 detections for dump

Cloud Monitoring1 detections

Auto-extracted: 1 detections for cloud monitoring

Cloud1 detections

Auto-extracted: 1 detections for cloud

Cloud1 detections

Auto-extracted: 1 detections for cloud

Credential1 detections

Auto-extracted: 1 detections for credential

Remote1 detections

Auto-extracted: 1 detections for remote

Download1 detections

Auto-extracted: 1 detections for download

DETECTIONS (53)

Automated Collection Command Prompt
sigmamedium
AWS Credentials Searched For Inside A Container
elastichigh
Azure Key Vault Modified or Deleted
sigmamedium
Azure Keyvault Key Modified or Deleted
sigmamedium
Azure Keyvault Secrets Modified or Deleted
sigmamedium
Cisco Collect Data
sigmalow
Cloud Credential Search Detected via Defend for Containers
elasticmedium
Copy Passwd Or Shadow From TMP Path
sigmahigh
Credential Access via TruffleHog Execution
elasticmedium
Credentials In Files
sigmahigh
Credentials In Files - Linux
sigmahigh
Extracting Information with PowerShell
sigmamedium
First Time Python Accessed Sensitive Credential Files
elasticmedium
FortiGate Configuration File Downloaded
elasticmedium
GenAI Process Accessing Sensitive Files
elastichigh
HackTool - Typical HiveNightmare SAM File Export
sigmahigh
HackTool - WinPwn Execution
sigmahigh
HackTool - WinPwn Execution - ScriptBlock
sigmahigh
Hidden Flag Set On File/Directory Via Chflags - MacOS
sigmamedium
Insensitive Subfolder Search Via Findstr.EXE
sigmalow
Kubeconfig File Creation or Modification
elasticmedium
Kubeconfig File Discovery
elasticlow
Kubernetes Service Account Secret Access
elasticmedium
Linux Recon Indicators
sigmahigh
MCP Github Suspicious Operation
splunk_escu
MCP Sensitive System File Search
splunk_escu
Microsoft IIS Connection Strings Decryption
elastichigh
Potential Credential Discovery via Recursive Grep
elastichigh
Potential Kerberos Attack via Bifrost
elastichigh
Potential password in username
splunk_escu
Potential PowerShell Console History Access Attempt via History File
sigmamedium
Potential Secret Scanning via Gitleaks
elasticmedium
Potentially Suspicious JWT Token Search Via CLI
sigmamedium
Private Key Searching Activity
elastichigh
PUA - TruffleHog Execution
sigmamedium
PUA - TruffleHog Execution - Linux
sigmamedium
Remote File Download Via Findstr.EXE
sigmamedium
Security File Access via Common Utilities
elasticlow
Sensitive File Compression Detected via Defend for Containers
elasticmedium
Sensitive Files Compression
elasticmedium
Sensitive Files Compression Inside A Container
elastichigh
Sensitive Keys Or Passwords Search Detected via Defend for Containers
elasticmedium
Sensitive Keys Or Passwords Searched For Inside A Container
elasticmedium
Service Account Token or Certificate Access Followed by Kubernetes API Request
elasticmedium
Service Account Token or Certificate Read Detected via Defend for Containers
elasticmedium
Shai-Hulud 2 Exfiltration Artifact Files
splunk_escu
Unusual Web Config File Access
elastichigh
Web Server Exploitation Detected via Defend for Containers
elastichigh
Web Server Local File Inclusion Activity
elasticlow
Web Server Potential Command Injection Request
elasticlow
Windows Unusual FileZilla XML Config Access
splunk_escu
Windows Unusual Intelliform Storage Registry Access
splunk_escu
Wireless Credential Dumping using Netsh Command
elastichigh