T1552.001 Credentials In Files

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping.(Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.(Citation: SRD GPP)

In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.PS-01.09 Virtualized end point protection Mitigates T1552.001 Credentials In Files
Comments
The diagnostic statement highlights several mechanisms that organizations can implement to protect endpoint systems using virtualization technologies, essentially hypervisor hardening. With this technique, adversaries may search host shared directories/filed between a VM and host device to find files of interest, specifically credentials in files. Hypervisor hardening can restrict or limit the ability to access files containing insecurely stored credentials between the virtualized machine and host system, making it harder for attackers to collect data from host shared files.
References
    PR.AA-01.01 Identity and credential management Mitigates T1552.001 Credentials In Files
    Comments
    This diagnostic statement protects against Credentials In Files through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
    References

      NIST 800-53 Mappings

      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
      CA-07 Continuous Monitoring mitigates T1552.001 Credentials In Files
      CM-06 Configuration Settings mitigates T1552.001 Credentials In Files
      IA-05 Authenticator Management mitigates T1552.001 Credentials In Files
      SC-12 Cryptographic Key Establishment and Management mitigates T1552.001 Credentials In Files
      SA-15 Development Process, Standards, and Tools mitigates T1552.001 Credentials In Files
      SC-28 Protection of Information at Rest mitigates T1552.001 Credentials In Files
      SC-04 Information in Shared System Resources mitigates T1552.001 Credentials In Files
      RA-05 Vulnerability Monitoring and Scanning mitigates T1552.001 Credentials In Files
      CM-02 Baseline Configuration mitigates T1552.001 Credentials In Files
      CM-02 Baseline Configuration mitigates T1552.001 Credentials In Files
      SA-11 Developer Testing and Evaluation mitigates T1552.001 Credentials In Files
      IA-02 Identification and Authentication (Organizational Users) mitigates T1552.001 Credentials In Files
      SI-04 System Monitoring mitigates T1552.001 Credentials In Files
      AC-02 Account Management mitigates T1552.001 Credentials In Files
      AC-04 Information Flow Enforcement mitigates T1552.001 Credentials In Files
      AC-05 Separation of Duties mitigates T1552.001 Credentials In Files
      AC-06 Least Privilege mitigates T1552.001 Credentials In Files
      SC-07 Boundary Protection mitigates T1552.001 Credentials In Files

      VERIS Mappings

      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
      action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1552.001 Credentials In Files
      attribute.confidentiality.data_disclosure None related-to T1552.001 Credentials In Files

      Azure Mappings

      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
      alerts_for_windows_machines Alerts for Windows Machines technique_scores T1552.001 Credentials In Files
      Comments
      This control can detect when commands associated with searching for passwords are executed.
      References

      GCP Mappings

      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
      cloud_hsm Cloud Hardware Security Module (HSM) technique_scores T1552.001 Credentials In Files
      Comments
      Google Cloud's HSM may protect against adversary's attempts to leverage passwords and unsecure credentials found in files on compromised systems.Variations of this technique are difficult to mitigate, so a partial score was granted for this control's medium to high coverage factor.
      References
      cloud_key_management Cloud Key Management technique_scores T1552.001 Credentials In Files
      Comments
      This control's protection is specific to a minority of this technique's sub-techniques and procedure examples resulting in a Minimal Coverage score and consequently an overall score of Minimal.
      References

      AWS Mappings

      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
      amazon_guardduty Amazon GuardDuty technique_scores T1552.001 Credentials In Files
      Comments
      The following finding types in Amazon GuardDuty can be used to identify potentially malicious interactions with S3 which may lead to the compromise of any credential files stored in S3: Impact:S3/MaliciousIPCaller Exfiltration:S3/MaliciousIPCaller Exfiltration:S3/ObjectRead.Unusual PenTest:S3/KaliLinux PenTest:S3/ParrotLinux PenTest:S3/PentooLinux UnauthorizedAccess:S3/MaliciousIPCaller.Custom UnauthorizedAccess:S3/TorIPCaller The score is capped at Partial since the findings only apply to credential files stored within S3 buckets and only certain types of suspicious behaviors.
      References
        aws_cloudhsm AWS CloudHSM technique_scores T1552.001 Credentials In Files
        Comments
        This service provides a more secure alternative to storing encryption keys in the file system. As a result of this service only supporting cryptographic keys and not other types of credentials, the coverage score is assessed as Partial resulting in an overall Partial score.
        References
          aws_config AWS Config technique_scores T1552.001 Credentials In Files
          Comments
          The following AWS Config managed rules can identify configuration problems that should be fixed in order to prevent malicious access of data within Amazon Simple Storage Service (S3) storage, which may include files containing credentials: "s3-account-level-public-access-blocks", "s3-bucket-level-public-access-prohibited", "s3-bucket-public-read-prohibited", "s3-bucket-policy-not-more-permissive", "cloudfront-origin-access-identity-enabled", and "cloudfront-default-root-object-configured" identify objects that are publicly available or subject to overly permissive access policies; and "s3-bucket-policy-grantee-check" checks whether bucket policies appropriately control which AWS principals, federated users, service principals, IP addresses, and VPCs have access. All of these controls are run on configuration changes. The following AWS Config managed rules can identify configuration problems that should be fixed in order to ensure that cloud storage data - which may include files containing credentials - are encrypted to prevent malicious access: "s3-bucket-server-side-encryption-enabled" and "s3-default-encryption-kms" for S3 storage, "ec2-ebs-encryption-by-default" and "encrypted-volumes" for EBS volumes. Coverage factor is partial for these rules, since they are specific to a subset of the available AWS services, resulting in an overall score of Partial.
          References
            aws_key_management_service AWS Key Management Service technique_scores T1552.001 Credentials In Files
            Comments
            This service provides a more secure alternative to storing encryption keys in the file system. As a result of this service only supporting cryptographic keys and not other types of credentials, the coverage score is assessed as Partial resulting in an overall Partial score.
            References
              aws_secrets_manager AWS Secrets Manager technique_scores T1552.001 Credentials In Files
              Comments
              This control may prevent harvesting of unsecured credentials by removing credentials and secrets from applications and configuration files and requiring authenticated API calls to retrieve those credentials and secrets. This control is relevant for credentials stored in applications or configuration files but not credentials entered directly by a user.
              References