T1552.001 Credentials In Files — Detection Rules

Source-backed rule directory

• Azure Keyvault Key Modified or Deleted · test · medium · {"product":"azure","service":"activitylogs"}
• Azure Key Vault Modified or Deleted · test · medium · {"product":"azure","service":"activitylogs"}
• Azure Keyvault Secrets Modified or Deleted · test · medium · {"product":"azure","service":"activitylogs"}
• Credentials In Files - Linux · test · high · {"product":"linux","service":"auditd"}
• Copy Passwd Or Shadow From TMP Path · test · high · {"product":"linux","category":"process_creation"}
• PUA - TruffleHog Execution - Linux · experimental · medium · {"category":"process_creation","product":"linux"}
• Linux Recon Indicators · test · high · {"category":"process_creation","product":"linux"}
• Hidden Flag Set On File/Directory Via Chflags - MacOS · test · medium · {"product":"macos","category":"process_creation"}
• Credentials In Files · test · high · {"product":"macos","category":"process_creation"}
• Cisco Collect Data · test · low · {"product":"cisco","service":"aaa"}
• HackTool - Typical HiveNightmare SAM File Export · test · high · {"product":"windows","category":"file_event"}
• HackTool - WinPwn Execution - ScriptBlock · test · high · {"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"}
• Extracting Information with PowerShell · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Remote File Download Via Findstr.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Insensitive Subfolder Search Via Findstr.EXE · test · low · {"category":"process_creation","product":"windows"}
• HackTool - WinPwn Execution · test · high · {"category":"process_creation","product":"windows"}
• Potential PowerShell Console History Access Attempt via History File · experimental · medium · {"category":"process_creation","product":"windows"}
• PUA - TruffleHog Execution · experimental · medium · {"category":"process_creation","product":"windows"}
• Automated Collection Command Prompt · test · medium · {"category":"process_creation","product":"windows"}
• Potentially Suspicious JWT Token Search Via CLI · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0307 Detect Access to Unsecured Credential Files Across Platforms

AN0856 Analytic 0856

Correlated file access to insecure credential files (e.g., *.env, *.xml, *.ps1) followed by suspicious process execution or authentication using retrieved credentials. Detected through Sysmon logs and Windows Security Event logs.

AN0857 Analytic 0857

File reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.

AN0858 Analytic 0858

Terminal-based grep or open of plist/config files containing credentials, correlated with Keychain or system login attempts.

AN0859 Analytic 0859

Container processes accessing mounted secrets or configuration paths (e.g., /run/secrets, /mnt/config) followed by network access or credential use.

AN0860 Analytic 0860

Access to local credential/config files (e.g., ~/.aws/credentials) followed by metadata API calls or cloud role assumptions.