MITRE ATT&CKsub-technique

T1552.001 Credentials In Files

Published 2020-02-04 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Containers, IaaS, Linux, macOS, Windows
Version
1.3
Created
2020-02-04

Description

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files. They may also be found as parameters to deployment commands in container logs. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1552 Unsecured Credentials technique

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (4)

  • M1047 Audit mitigation
  • M1017 User Training mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (44)

  • S9050 Vidar software (malware)
  • S9045 BACKUPOSINT v9.0 APEX PREDATOR software (malware)
  • S9044 Kali365 software (malware)
  • G1057 ShinyHunters group
  • S9043 Mini Shai-Hulud software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • S9008 Shai-Hulud software (malware)
  • S9009 TruffleHog software (tool)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1045 Salt Typhoon group
  • C0049 Leviathan Australian Intrusions campaign
  • S1183 StrelaStealer software (malware)
  • G1039 RedCurl group
  • G1016 FIN13 group
  • G1015 Scattered Spider group
  • G1003 Ember Bear group
  • S0677 AADInternals software (tool)
  • G0139 TeamTNT group
  • S0601 Hildegard software (malware)
  • S0583 Pysa software (malware)
  • G0119 Indrik Spider group
  • G0117 Fox Kitten group
  • G0094 Kimsuky group
  • G0092 TA505 group
  • S0378 PoshC2 software (tool)
  • S0367 Emotet software (malware)
  • S0363 Empire software (tool)
  • S0344 Azorult software (malware)
  • S0349 LaZagne software (tool)
Show all 44 ›

Referenced by CAPEC · att&ck technique (2)

  • CAPEC-191 Read Sensitive Constants Within an Executable attack pattern
  • CAPEC-639 Probe System Files attack pattern

Referenced by Compliance · mitigates (19)

  • CIS-4.11 Enforce Remote Wipe Capability on Portable End-User Devices CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-4 Information in Shared System Resources NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References