{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1552","id":"T1552","name":"Unsecured Credentials","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1552","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"86a9702eff52b2f0aa22d792dbee1658e50c0595ba533e60464fb3f96a654d25","description":"Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)),  or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1552","external_id":"T1552"},{"source_name":"Brining MimiKatz to Unix","description":"Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.","url":"https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf"}],"platforms":["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1552.001","id":"T1552.001","name":"Credentials In Files","page":"techniques/enterprise/T1552.001/"},{"key":"enterprise/T1552.002","id":"T1552.002","name":"Credentials in Registry","page":"techniques/enterprise/T1552.002/"},{"key":"enterprise/T1552.003","id":"T1552.003","name":"Shell History","page":"techniques/enterprise/T1552.003/"},{"key":"enterprise/T1552.004","id":"T1552.004","name":"Private Keys","page":"techniques/enterprise/T1552.004/"},{"key":"enterprise/T1552.005","id":"T1552.005","name":"Cloud Instance Metadata API","page":"techniques/enterprise/T1552.005/"},{"key":"enterprise/T1552.006","id":"T1552.006","name":"Group Policy Preferences","page":"techniques/enterprise/T1552.006/"},{"key":"enterprise/T1552.007","id":"T1552.007","name":"Container API","page":"techniques/enterprise/T1552.007/"},{"key":"enterprise/T1552.008","id":"T1552.008","name":"Chat Messages","page":"techniques/enterprise/T1552.008/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0070","name":"Cloud Service Metadata","page":"telemetry/DC0070/","kind":"attack_component","category":"Cloud control plane","description":"Cloud service inventory and current configuration.","collection_focus":"Export service configuration with resource ID, region, status and enabled logging features using least-privileged read access.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["resource_id","service","enabled","retention_days"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0070","collector":"illustrative-lab-collector","observation":{"resource_id":"lab-service-1","service":"lab-audit-service","enabled":true,"retention_days":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1552","id":"T1552","name":"Unsecured Credentials","domain":"enterprise","platforms":["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1552","technique_page":"techniques/enterprise/T1552/","page":"detections/enterprise/T1552/","status":"rule_source_available","counts":{"sigma":12,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":7,"live_validated":0},"sigma_rules":[{"id":"eed82177-38f5-4299-8a76-098d50d225ab","title":"Kubernetes Admission Controller Modification","status":"test","level":"medium","logsource":{"product":"kubernetes","service":"audit"},"data_path":"data/detection-rules/eed82177-38f5-4299-8a76-098d50d225ab.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml","author":"kelnage","kind":"sigma"},{"id":"80eeab92-0979-4152-942d-96749e11df40","title":"Azure Keyvault Key Modified or Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/80eeab92-0979-4152-942d-96749e11df40.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"459a2970-bb84-4e6a-a32e-ff0fbd99448d","title":"Azure Key Vault Modified or Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/459a2970-bb84-4e6a-a32e-ff0fbd99448d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"b831353c-1971-477b-abb6-2828edc3bca1","title":"Azure Keyvault Secrets Modified or Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/b831353c-1971-477b-abb6-2828edc3bca1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"a61a3c56-4ce2-4351-a079-88ae4cbd2b58","title":"Azure Kubernetes Admission Controller","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/a61a3c56-4ce2-4351-a079-88ae4cbd2b58.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"1b45b0d1-773f-4f23-aedc-814b759563b1","title":"Application AppID Uri Configuration Changes","status":"test","level":"high","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/1b45b0d1-773f-4f23-aedc-814b759563b1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","kind":"sigma"},{"id":"74298991-9fc4-460e-a92e-511aa60baec1","title":"Added Owner To Application","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/74298991-9fc4-460e-a92e-511aa60baec1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_app_owner_added.yml","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","kind":"sigma"},{"id":"6ad91e31-53df-4826-bd27-0166171c8040","title":"Google Cloud Kubernetes Admission Controller","status":"test","level":"medium","logsource":{"product":"gcp","service":"gcp.audit"},"data_path":"data/detection-rules/6ad91e31-53df-4826-bd27-0166171c8040.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"91b76b84-8589-47aa-9605-c837583b82a9","title":"Potential Okta Password in AlternateID Field","status":"test","level":"high","logsource":{"product":"okta","service":"okta"},"data_path":"data/detection-rules/91b76b84-8589-47aa-9605-c837583b82a9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/identity/okta/okta_password_in_alternateid_field.yml","author":"kelnage","kind":"sigma"},{"id":"f0025a69-e1b7-4dda-a53c-db21fa2d4071","title":"Script Interpreter Spawning Credential Scanner - Linux","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/f0025a69-e1b7-4dda-a53c-db21fa2d4071.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_script_interpretor_spawn_credential_scanner.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"beaa66d6-aa1b-4e3c-80f5-e0145369bfaf","title":"Potentially Suspicious EventLog Recon Activity Using Log Query Utilities","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/beaa66d6-aa1b-4e3c-80f5-e0145369bfaf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","kind":"sigma"},{"id":"0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6","title":"Script Interpreter Spawning Credential Scanner - Windows","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1552-1","technique_id":"T1552","title":"T1552 Unsecured Credentials","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#credential-access","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":121,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L121","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"cfd3ca834511a6fa9daf40ff17329a8636d7db5cfa55f9be8eda6957e751290c","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(file_content_or_path_matches_credential_pattern) OR MATCH(secret_retrieval BY unauthorized_identity) -> ALERT","log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Secrets-Management Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#95-secrets-management-logs"},{"title":"Cloud Secrets-Manager Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#113-cloud-secrets-manager-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1552-1","technique_id":"T1552","title":"Cloud secrets, keys, or tokens retrieved — T1552 Unsecured Credentials","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#secret-retrieval","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":82,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L82","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"78f916cbd31474dcd2865ce2ae25442ad044fdb800993cc2bb664a90493a4660","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"identity-secret relationship.","expected_behavior":"stable identities access specific secret sets.","deviation":"new edge, peer-group deviation, or sudden access burst.","anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"}],"log_sources":[{"title":"Cloud Secrets-Manager Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#113-cloud-secrets-manager-logs"},{"title":"Secrets-Management Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#95-secrets-management-logs"}],"context_references":[{"title":"Sysdig SCARLETEEL investigation — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/sysdig-scarleteel.html"},{"title":"original source","url":"https://www.sysdig.com/blog/cloud-breach-terraform-data-theft"}]}],"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}],"strategies":[{"id":"DET0412","name":"Detect Access or Search for Unsecured Credentials Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0412","stix_id":"x-mitre-detection-strategy--d1912fbc-aaac-4bb1-82f1-0713280ca9a1","relationship_id":"relationship--9a673d77-b594-4115-9ffa-b1b38cf6de18","description":"","analytics":[{"id":"AN1153","name":"Analytic 1153","guidance":"Unusual access to bash history, registry credentials paths, or private key files by unauthorized or scripting tools, with correlated file and process activity.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1153","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Defines the threshold time for accessing multiple sensitive files indicating automation."},{"field":"SuspiciousProcessList","description":"Process names to monitor (e.g., reg.exe, cmd.exe, powershell.exe, etc.)"}],"log_sources":[{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1153","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1153","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1153","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1153","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN1153","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1153","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN1154","name":"Analytic 1154","guidance":"Reading of sensitive files like .bash_history, /etc/shadow, or private key directories by unauthorized users or unusual processes.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1154","platforms":["Linux"],"tuning":[{"field":"SensitivePaths","description":"Paths to credential files such as /etc/shadow or ~/.bash_history"},{"field":"UserContext","description":"Whether the process runs under a privileged or non-interactive session"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open/read system calls to ~/.bash_history or /etc/shadow","platforms":["Linux"],"analytic_id":"AN1154","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1154","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"execution of tools like cat, grep, or awk on credential files","platforms":["Linux"],"analytic_id":"AN1154","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1154","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1155","name":"Analytic 1155","guidance":"Unusual access to ~/Library/Keychains, ~/.bash_history, or Terminal command history by unauthorized processes or users.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1155","platforms":["macOS"],"tuning":[{"field":"ProcessName","description":"Tool or command used to query credentials (e.g., security, grep)"},{"field":"TargetPath","description":"Credential file paths (e.g., ~/Library/Keychains)"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"macos:unifiedlog","channel":"read access to ~/Library/Keychains or history files by terminal processes","platforms":["macOS"],"analytic_id":"AN1155","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1155","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"execution of 'security', 'cat', or 'grep' commands accessing credential storage","platforms":["macOS"],"analytic_id":"AN1155","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1155","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1156","name":"Analytic 1156","guidance":"Unusual web-based access or API scraping of password managers, single sign-on sessions, or credential sync services via browser automation or anomalous API tokens.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1156","platforms":["SaaS"],"tuning":[{"field":"TokenAnomalyThreshold","description":"Scoring threshold for access token entropy, reuse, or bot-like patterns"},{"field":"AccessGeoLocation","description":"Region anomalies in SaaS portal access"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"saas:googleworkspace","channel":"Accessed third-party credential management service","platforms":["SaaS"],"analytic_id":"AN1156","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1156","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0038","component":"Application Log Content","name":"saas:zoom","channel":"unusual web session tokens and automation patterns during login","platforms":["SaaS"],"analytic_id":"AN1156","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1156","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1157","name":"Analytic 1157","guidance":"Unauthorized API or console calls to retrieve or reset password credentials, download key material, or modify SSO settings.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1157","platforms":["Identity Provider"],"tuning":[{"field":"SSOSettingScope","description":"Subset of IdP settings monitored for unauthorized changes"},{"field":"SecretType","description":"Which secrets (passwords, keys, tokens) are monitored"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"azure:signinlogs","channel":"Reset password or download key from portal","platforms":["Identity Provider"],"analytic_id":"AN1157","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1157","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0070","component":"Cloud Service Metadata","name":"AWS:CloudTrail","channel":"GetSecretValue","platforms":["Identity Provider"],"analytic_id":"AN1157","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1157","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0070/"}]},{"id":"AN1158","name":"Analytic 1158","guidance":"Access to container image layers or mounted secrets (e.g., Docker secrets) by processes not tied to entrypoint or orchestration context.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1158","platforms":["Containers"],"tuning":[{"field":"EntrypointAllowlist","description":"Container entrypoints that are permitted to read secrets"},{"field":"VolumeMountPath","description":"Paths to credentials/secrets inside container images"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"read of /run/secrets or docker volumes by non-entrypoint process","platforms":["Containers"],"analytic_id":"AN1158","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1158","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0032","component":"Process Creation","name":"containerd:Events","channel":"unusual process spawned from container image context","platforms":["Containers"],"analytic_id":"AN1158","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1158","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1159","name":"Analytic 1159","guidance":"Use of configuration backup utilities or CLI access to dump plaintext passwords, local user hashes, or SNMP strings.","url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1159","platforms":["Network Devices"],"tuning":[{"field":"ManagementInterfaceIPs","description":"IP ranges authorized to perform credential dumps"},{"field":"CommandPattern","description":"Regex patterns for suspicious CLI commands"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"linux:syslog","channel":"CLI access to 'show running-config', 'show password', or 'cat config.txt'","platforms":["Network Devices"],"analytic_id":"AN1159","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1159","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"large transfer from management IPs to unauthorized host","platforms":["Network Devices"],"analytic_id":"AN1159","source_url":"https://attack.mitre.org/detectionstrategies/DET0412#AN1159","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0070","name":"Cloud Service Metadata","tag":"Cloud Service Metadata","page":"telemetry/DC0070/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1131","name":"NPPSPY","page":"tools/S1131/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1131","name":"NPPSPY","page":"tools/S1131/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0373","name":"Astaroth","url":"https://attack.mitre.org/software/S0373","kind":"malware","description":"[Astaroth](https://attack.mitre.org/software/S0373) uses an external software known as NetPass to recover passwords. (Citation: Cybereason Astaroth Feb 2019)","relationship_id":"relationship--be30816a-854a-4568-ade5-8baa60fa087c","references":[{"source_name":"Cybereason Astaroth Feb 2019","description":"Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.","url":"https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"}]},{"id":"S1091","name":"Pacu","url":"https://attack.mitre.org/software/S1091","kind":"tool","description":"[Pacu](https://attack.mitre.org/software/S1091) can search for sensitive data: for example, in Code Build environment variables, EC2 user data, and Cloud Formation templates.(Citation: GitHub Pacu)","relationship_id":"relationship--7d5cc26f-780f-4897-bae0-811e6b8bfa30","references":[{"source_name":"GitHub Pacu","description":"Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.","url":"https://github.com/RhinoSecurityLabs/pacu"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) uses NirSoft tools to steal user credentials from the infected machine.(Citation: Ensilo Darkgate 2018) NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.","relationship_id":"relationship--59f009e1-8175-439e-9fb1-6c37ae392307","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}]},{"id":"S1131","name":"NPPSPY","url":"https://attack.mitre.org/software/S1131","kind":"tool","description":"[NPPSPY](https://attack.mitre.org/software/S1131) captures credentials by recording them through an alternative network listener registered to the <code>mpnotify.exe</code> process, allowing for cleartext recording of logon information.(Citation: Huntress NPPSPY 2022)","relationship_id":"relationship--dc434717-4497-4832-a1ff-d8f376022ff4","references":[{"source_name":"Huntress NPPSPY 2022","description":"Dray Agha. (2022, August 16). Cleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPY. Retrieved May 17, 2024.","url":"https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy"}]}],"actors":[{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"\n[Volt Typhoon](https://attack.mitre.org/groups/G1017) has obtained credentials insecurely stored on targeted network appliances.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--d0718f47-ad79-4d04-a9d9-7bc97371a947","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has obtained credentials from internal service ticketing systems.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--cf07a411-af81-4945-8c6f-511e04a978c2","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[{"id":"M1015","name":"Active Directory Configuration","url":"https://attack.mitre.org/mitigations/M1015","kind":"course-of-action","description":"Remove vulnerable Group Policy Preferences.(Citation: Microsoft MS14-025)","relationship_id":"relationship--2b36db33-4f97-4228-bcca-4f453d1bd533","references":[{"source_name":"Microsoft MS14-025","description":"Microsoft. (2014, May 13). MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege. Retrieved January 28, 2015.","url":"http://support.microsoft.com/kb/2962486"}]},{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.","relationship_id":"relationship--246e4d06-8646-4f9a-8d7c-1efd98fd11c1","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Restrict file shares to specific directories with access only to necessary users.","relationship_id":"relationship--8497e912-185d-403b-865e-17c4b02290d2","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"If it is necessary that software must store credentials in the Registry, then ensure the associated accounts have limited permissions so they cannot be abused if obtained by an adversary.","relationship_id":"relationship--e30864c0-df50-403b-9ad0-ef744a5d7449","references":[]},{"id":"M1027","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M1027","kind":"course-of-action","description":"Use strong passphrases for private keys to make cracking difficult. Do not store credentials within the Registry. Establish an organizational policy that prohibits password storage in files.","relationship_id":"relationship--529b0951-548c-4316-93d1-baf97d89f10a","references":[]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"There are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands:\n<code>set +o history</code> and <code>set -o history</code> to start logging again;\n<code>unset HISTFILE</code> being added to a user's .bash_rc file; and\n<code>ln -s /dev/null ~/.bash_history</code> to write commands to <code>/dev/null</code>instead.","relationship_id":"relationship--5401a61d-a795-4619-aa7e-fdf54cd4358e","references":[]},{"id":"M1035","name":"Limit Access to Resource Over Network","url":"https://attack.mitre.org/mitigations/M1035","kind":"course-of-action","description":"Limit network access to sensitive services, such as the Instance Metadata API.","relationship_id":"relationship--aa206b5b-9ea2-4f68-a4a0-4060e760c2cd","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Limit access to the Instance Metadata API. A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.(Citation: RedLock Instance Metadata API 2018)","relationship_id":"relationship--6607178e-a8b4-4da9-b985-3712eb71a303","references":[{"source_name":"RedLock Instance Metadata API 2018","description":"Higashi, Michael. (2018, May 15). Instance Metadata API: A Modern Day Trojan Horse. Retrieved July 16, 2019.","url":"https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse"}]},{"id":"M1041","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M1041","kind":"course-of-action","description":"When possible, store keys on separate cryptographic hardware instead of on the local system. ","relationship_id":"relationship--069ff8f0-889c-4463-bf5d-618bf5e457ee","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Preemptively search for files containing passwords or other credentials and take actions to reduce the exposure risk when found.","relationship_id":"relationship--abe43d10-714a-4f29-b164-d7cadd83cb61","references":[]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Apply patch KB2962486 which prevents credentials from being stored in GPPs.(Citation: ADSecurity Finding Passwords in SYSVOL)(Citation: MS14-025)","relationship_id":"relationship--1974c8c2-d97b-4ea3-9ed4-61a8d0cd2fdd","references":[{"source_name":"ADSecurity Finding Passwords in SYSVOL","description":"Sean Metcalf. (2015, December 28). Finding Passwords in SYSVOL & Exploiting Group Policy Preferences. Retrieved February 17, 2020.","url":"https://adsecurity.org/?p=2288"},{"source_name":"MS14-025","description":"Microsoft. (2014, May 13). MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege. Retrieved February 17, 2020.","url":"https://support.microsoft.com/en-us/help/2962486/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevati"}]}],"candidates":[{"id":"a21118de-b11e-4ebd-b655-42f11142df0c","name":"AWS - Retrieve EC2 Password Data using stratus","platforms":["linux","macos","iaas:aws"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552/T1552.yaml","description":"This atomic runs an API call GetPasswordData from a role that does not have permission to do so. This simulates an attacker attempting to retrieve RDP passwords on a high number of Windows EC2 instances. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/\n","inputs":{"stratus_path":{"description":"Path of stratus binary","type":"path","default":"$PathToAtomicsFolder/T1552/src"},"aws_region":{"description":"AWS region to detonate","type":"string","default":"us-west-2"}},"dependencies":[{"description":"Stratus binary must be present at the (#{stratus_path}/stratus)\n"},{"description":"Check if ~/.aws/credentials file has a default stanza is configured\n"}],"source_definition_sha256":"d3cc48e8664af6934d49d28f2b6addfcb6d89d7f1e8e0627eda66ec4260ea51e"},{"id":"f9c3d0ab-479b-4019-945f-22ace2b1731a","name":"Search for Passwords in Powershell History","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552/T1552.yaml","description":"Find passwords in the powershell history files\nSearching for following strings: \"password\", \"-p\", \"key\", \"pwd\", \"pass\"\n","inputs":{},"dependencies":[],"source_definition_sha256":"6584eceb7f259286a623aff326eee03fdad2eec09fa8e4044a5242fb4be4ac9e"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1552.003":"/ttp-simulation/techniques/enterprise/T1552.003/","T1552.002":"/ttp-simulation/techniques/enterprise/T1552.002/","T1552.004":"/ttp-simulation/techniques/enterprise/T1552.004/","T1552":"/ttp-simulation/techniques/enterprise/T1552/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1552","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0070","collector":"illustrative-lab-collector","observation":{"resource_id":"lab-service-1","service":"lab-audit-service","enabled":true,"retention_days":30}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}