MITRE ATT&CKsub-technique

T1552.004 Private Keys

Published 2020-02-04 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Linux, macOS, Network Devices, Windows
Version
1.3
Created
2020-02-04

Description

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates. When a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device’s identity. An adversary with access to the device may be able to export the keys in order to impersonate the device. On network devices, private keys may be exported via Network Device CLI commands such as `crypto pki export`. Some private keys require a password or passphrase for operation, so an adversary may also use Input Capture for keylogging or attempt to Brute Force the passphrase off-line. These private keys can be used to authenticate to Remote Services like SSH or for use in decrypting other collected files such as email.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1552 Unsecured Credentials technique

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (4)

  • M1041 Encrypt Sensitive Information mitigation
  • M1047 Audit mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (25)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • G1056 TeamPCP group
  • S9041 TeamPCP Cloud Stealer software (malware)
  • G1053 Storm-0501 group
  • S1196 Troll Stealer software (malware)
  • G1017 Volt Typhoon group
  • G1015 Scattered Spider group
  • C0024 SolarWinds Compromise campaign
  • S1060 Mafalda software (malware)
  • C0014 Operation Wocao campaign
  • S0677 AADInternals software (tool)
  • S0661 FoggyWeb software (malware)
  • G0139 TeamTNT group
  • S0601 Hildegard software (malware)
  • S0599 Kinsing software (malware)
  • G0106 Rocke group
  • S0409 Machete software (malware)
  • G0094 Kimsuky group
  • S0377 Ebury software (malware)
  • S0363 Empire software (tool)
  • G0082 APT38 group
  • S0283 jRAT software (malware)
  • S0002 Mimikatz software (tool)

Referenced by CAPEC · att&ck technique (4)

  • CAPEC-37 Retrieve Embedded Sensitive Data attack pattern
  • CAPEC-474 Signature Spoofing by Key Theft attack pattern
  • CAPEC-485 Signature Spoofing by Key Recreation attack pattern
  • CAPEC-639 Probe System Files attack pattern

Referenced by Compliance · mitigates (24)

  • CIS-3.11 Encrypt Sensitive Data At Rest CIS Safeguard v8.1
  • CIS-4.11 Enforce Remote Wipe Capability on Portable End-User Devices CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-18 Wireless Access NIST 800-53 control
  • NIST-AC-19 Access Control for Mobile Devices NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-4 Information in Shared System Resources NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References