T1552 Unsecured Credentials

Adversaries may search compromised systems to find and obtain insecurely stored credentials. MITRE ATT&CK

4 Sigma rules T1552 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1552.001Unsecured Credentials: Credentials In Files

T1552.002Unsecured Credentials: Credentials in Registry

T1552.003Unsecured Credentials: Shell History

T1552.004Unsecured Credentials: Private Keys

T1552.006Unsecured Credentials: Group Policy Preferences

Sigma rules tagged with it

process creation, the highest levels first

highScript Interpreter Spawning Credential Scanner - LinuxSwachchhanda Shrawan Poudel (Nextron Systems) · Linux

highScript Interpreter Spawning Credential Scanner - WindowsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumEventLog Query Requests By Builtin UtilitiesAli Alwashali, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumPotentially Suspicious EventLog Recon Activity Using Log Query UtilitiesNasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Display the three most recent events from the Application log in textual format on the page for wevtutil

wevtutil qe Application /c:3 /rd:true /f:textIdentify

Convert the PowerShell event log to CSV on the page for ConvertTo-Csv

(Get-Culture).TextInfo.ListSeparator
Get-WinEvent -LogName 'Windows PowerShell' | ConvertTo-Csv -UseCulture -NoTypeInformation

Identify

Create a web page to display PowerShell events on the page for ConvertTo-Html

Get-EventLog -LogName "Windows PowerShell" | ConvertTo-Html | Out-File pslog.htmIdentify

Create a web page to display PowerShell events on the page for ConvertTo-Html

Get-EventLog -Log "Windows PowerShell" | ConvertTo-Html -Property Id, Level, TaskIdentify

Operate on the most recent System events on the page for ForEach-Object

Get-EventLog -LogName System -Newest 1000 |
ForEach-Object -Begin {Get-Date} -Process {
Out-File -FilePath Events.txt -Append -InputObject $_.Message
} -End {Get-Date}

Identify

Get event logs on the local computer on the page for Get-EventLog

Get-EventLog -ListIdentify

Get recent entries from an event log on the local computer on the page for Get-EventLog

Get-EventLog -LogName System -Newest 5Identify

Find all sources for a specific number of entries in an event log on the page for Get-EventLog

$Events = Get-EventLog -LogName System -Newest 1000
$Events | Group-Object -Property Source -NoElement | Sort-Object -Property Count -Descending

Identify

Get error events from a specific event log on the page for Get-EventLog

Get-EventLog -LogName System -EntryType ErrorIdentify

Get events from an event log with an InstanceId and Source value on the page for Get-EventLog

Get-EventLog -LogName System -InstanceId 10016 -Source DCOMIdentify

Get events from multiple computers on the page for Get-EventLog

Get-EventLog -LogName System -ComputerName Server01, Server02, Server03Identify

Get all events that include a specific word in the message on the page for Get-EventLog

Get-EventLog -LogName System -Message descriptionIdentify

And 33 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1552: a Sigma rule it trips is tagged with it, or its abuse is documented as it.