T1552.001 Unsecured Credentials: Credentials In Files

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. MITRE ATT&CK

1 program on CmdID 14 Sigma rules T1552.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1552Unsecured Credentials

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

criticalPotential Russian APT Credential Theft ActivityFlorian Roth (Nextron Systems) · Windows

highCopy Passwd Or Shadow From TMP PathJoseliyo Sanchez, @Joseliyo_Jstnk · Linux

highCredentials In FilesIgor Fits, Mikhail Larin, oscd.community · macOS

highHackTool - WinPwn ExecutionSwachchhanda Shrawan Poudel · Windows

highLinux Recon IndicatorsFlorian Roth (Nextron Systems) · Linux

mediumPotentially Suspicious JWT Token Search Via CLINasreddine Bencherchali (Nextron Systems), kagebunsher · Windows

mediumPUA - TruffleHog ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumPUA - TruffleHog Execution - LinuxSwachchhanda Shrawan Poudel (Nextron Systems) · Linux

mediumRemote File Download Via Findstr.EXEFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · Windows

lowInsensitive Subfolder Search Via Findstr.EXEFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · Windows

everyday examples from tldr-pages, CC BY 4.0

Set the hidden flag for a file on the page for chflags

chflags hidden path/to/fileIdentify

Unset the hidden flag for a file on the page for chflags

chflags nohidden path/to/fileIdentify

Scan a Git repository for verified secrets on the page for trufflehog

trufflehog git https://github.com/trufflesecurity/test_keys --only-verifiedIdentify

Scan a GitHub organization for verified secrets on the page for trufflehog

trufflehog github --org trufflesecurity --only-verifiedIdentify

Scan a GitHub repository for verified keys and get JSON output on the page for trufflehog

trufflehog git https://github.com/trufflesecurity/test_keys --only-verified --jsonIdentify

Scan a GitHub repository along with its Issues and Pull Requests on the page for trufflehog

trufflehog github --repo https://github.com/trufflesecurity/test_keys --issue-comments --pr-commentsIdentify

Scan an S3 bucket for verified keys on the page for trufflehog

trufflehog s3 --bucket bucket_name --only-verifiedIdentify

Scan S3 buckets using IAM Roles on the page for trufflehog

trufflehog s3 --role-arn iam_role_arnIdentify

Scan individual files or directories on the page for trufflehog

trufflehog filesystem path/to/file_or_directory1 path/to/file_or_directory2 ...Identify

Scan a Docker image for verified secrets on the page for trufflehog

trufflehog docker --image trufflesecurity/secrets --only-verifiedIdentify

An example is here when CmdID’s reading of it names T1552.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.