MITRE ATT&CKtechnique

T1552 Unsecured Credentials

Published 2020-02-04 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider
Version
1.5
Created
2020-02-04

Description

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Related

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (11)

  • M1035 Limit Access to Resource Over Network mitigation
  • M1037 Filter Network Traffic mitigation
  • M1041 Encrypt Sensitive Information mitigation
  • M1047 Audit mitigation
  • M1051 Update Software mitigation
  • M1015 Active Directory Configuration mitigation
  • M1017 User Training mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation
  • M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · subtechnique of (8)

Referenced by MITRE ATT&CK · uses (8)

  • G1059 NIMBUS MANTICORE group
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • C0049 Leviathan Australian Intrusions campaign
  • S1131 NPPSPY software (tool)
  • S1111 DarkGate software (malware)
  • S1091 Pacu software (tool)
  • G1017 Volt Typhoon group
  • S0373 Astaroth software (malware)

Referenced by Compliance · mitigates (38)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-3.11 Encrypt Sensitive Data At Rest CIS Safeguard v8.1
  • CIS-3.5 Securely Dispose of Data CIS Safeguard v8.1
  • CIS-7.3 Perform Automated Operating System Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-18 Wireless Access NIST 800-53 control
  • NIST-AC-19 Access Control for Mobile Devices NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
Show all 38 ›

References