Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).(Citation: Brining MimiKatz to Unix)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| attribute.confidentiality.data_disclosure | Confirmed or potential data disclosure | related-to | T1552 | Unsecured Credentials |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| cloud_hsm | Cloud Hardware Security Module (HSM) | technique_scores | T1552 | Unsecured Credentials |
Comments
Google Cloud's HSM may protect against adversary's attempts to leverage unsecured credentials found on compromised systems. Variations of this technique are difficult to mitigate, so a partial score was granted for this control's medium to high coverage factor.
References
|
| cloud_key_management | Cloud Key Management | technique_scores | T1552 | Unsecured Credentials |
Comments
Cloud Key Management Service allows you to create, import, and manage cryptographic keys and perform cryptographic operations in a single centralized cloud service. Unsecured Credentials can be moved to the Cloud Key Management Service to protect from being stolen or abused. Since this service does not actually identify credentials that are currently insecure the score is low.
References
|
| google_secops | Google Security Operations | technique_scores | T1552 | Unsecured Credentials |
Comments
Google Security Ops detects an attempt to scan registry hives for unsecured passwords.
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/ioc_sigma/process_creation/t1214___credentials_in_registry.yaral
References
|
| secret_manager | Secret Manager | technique_scores | T1552 | Unsecured Credentials |
Comments
This control provides a central, secure location for storage of credentials to reduce the possibility of attackers discovering unsecured credentials.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1552.005 | Cloud Instance Metadata API | 3 |
| T1552.002 | Credentials in Registry | 2 |
| T1552.004 | Private Keys | 4 |
| T1552.003 | Shell History | 2 |
| T1552.001 | Credentials In Files | 4 |
| T1552.006 | Group Policy Preferences | 3 |
| T1552.008 | Chat Messages | 4 |
| T1552.007 | Container API | 5 |