[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1552":3},{"item":4,"lessons":18,"controls":52,"related":81},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1552","T1552","Unsecured Credentials",8,"MITRE","**What attackers do.** Attackers search compromised systems and repositories for credentials stored insecurely, such as passwords in files, scripts, registry keys, shell history, cloud metadata services, private keys or code. This serves the Credential Access tactic.\n\n**How to defend.** Move secrets into a managed vault, scan code repositories and file shares for exposed credentials, and rotate anything found. Protect cloud instance metadata services with the hardened versions that require session tokens. Limit access to configuration files and shell histories.\n\n**Signs to look for.** Look for searches across file shares for words like password, access to private key files, requests to instance metadata services from unusual processes, and use of credentials from unexpected hosts. A common gap is secrets embedded in old scripts and deployment files that nobody owns.","Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and\u002For misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry),  or other specialized files\u002Fartifacts (e.g. Private Keys).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1552\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48],{"slug":21,"title":22,"published_at":23},"ai-coding-agents-require-dedicated-endpoint-visibility-and-forensic-controls","AI Coding Agents Require Dedicated Endpoint Visibility and Forensic Controls","2026-10-12T12:21:09.449+00:00",{"slug":25,"title":26,"published_at":27},"compromised-identity-opens-door-to-cloud-devops-pipeline-takeover","Compromised Identity Opens Door to Cloud DevOps Pipeline Takeover","2026-09-29T18:21:58.594+00:00",{"slug":29,"title":30,"published_at":31},"ai-powered-botnet-exploits-exposed-docker-hosts-to-steal-credentials","AI-Powered Botnet Exploits Exposed Docker Hosts to Steal Credentials","2026-09-28T22:21:13.3+00:00",{"slug":33,"title":34,"published_at":35},"marimo-rce-exploited-to-reach-ssh-bastion-in-eight-seconds","Marimo RCE Exploited to Reach SSH Bastion in Eight Seconds","2026-09-15T14:22:29.939+00:00",{"slug":37,"title":38,"published_at":39},"ai-powered-credential-harvesting-campaign-steals-thousands-of-api-keys-in-hours","AI-Powered Credential Harvesting Campaign Steals Thousands of API Keys in Hours","2026-09-08T16:23:03.704+00:00",{"slug":41,"title":42,"published_at":43},"700-ai-agents-exploit-ssrf-and-exposed-api-tokens-to-breach-hugging-face","700 AI Agents Exploit SSRF and Exposed API Tokens to Breach Hugging Face","2026-08-28T14:21:51.731+00:00",{"slug":45,"title":46,"published_at":47},"passkey-attacks-bypass-phishing-resistant-mfa-without-breaking-cryptography","Passkey Attacks Bypass Phishing-Resistant MFA Without Breaking Cryptography","2026-08-10T14:21:05.845+00:00",{"slug":49,"title":50,"published_at":51},"azure-cosmos-db-sandbox-escape-exposed-platform-wide-signing-keys","Azure Cosmos DB Sandbox Escape Exposed Platform-Wide Signing Keys","2026-07-30T16:22:42.027+00:00",[53,58,63,67,72,77],{"slug":54,"name":55,"problem":56,"stories":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":59,"name":60,"problem":61,"stories":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",4,{"slug":64,"name":65,"problem":66,"stories":62},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":68,"name":69,"problem":70,"stories":71},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",3,{"slug":73,"name":74,"problem":75,"stories":76},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,{"slug":78,"name":79,"problem":80,"stories":76},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[82,87,93,97,102,106,110,113],{"family":83,"item":84,"code":85,"title":86,"together":9},"cis","6","Control 6","Access Control Management",{"family":88,"item":89,"code":90,"title":91,"together":92},"nist-800-53","ia-5","IA-5","Authenticator Management",6,{"family":83,"item":94,"code":95,"title":96,"together":62},"12","Control 12","Network Infrastructure Management",{"family":98,"item":99,"code":100,"title":101,"together":62},"gdpr","32","Article 32","Security of processing",{"family":88,"item":103,"code":104,"title":105,"together":62},"ac-2","AC-2","Account Management",{"family":88,"item":107,"code":108,"title":109,"together":62},"ac-6","AC-6","Least Privilege",{"family":83,"item":111,"code":112,"title":105,"together":71},"5","Control 5",{"family":83,"item":114,"code":115,"title":116,"together":71},"13","Control 13","Network Monitoring and Defense"]