THREATNOIR
Subscribe
MITRE ATT&CK · T1552

Unsecured Credentials

MITRE · cited in 8 of our lessons

Explanation

What attackers do. Attackers search compromised systems and repositories for credentials stored insecurely, such as passwords in files, scripts, registry keys, shell history, cloud metadata services, private keys or code. This serves the Credential Access tactic.

How to defend. Move secrets into a managed vault, scan code repositories and file shares for exposed credentials, and rotate anything found. Protect cloud instance metadata services with the hardened versions that require session tokens. Limit access to configuration files and shell histories.

Signs to look for. Look for searches across file shares for words like password, access to private key files, requests to instance metadata services from unusual processes, and use of credentials from unexpected hosts. A common gap is secrets embedded in old scripts and deployment files that nobody owns.

Open the technique on MITRE ATT&CK
The official text
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.