Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)
In cloud environments, authenticated user credentials are often stored in local configuration and credential files. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files. (Citation: Specter Ops - Cloud Credential Storage)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| azure_sentinel | Azure Sentinel | technique_scores | T1552.001 | Credentials In Files |
Comments
The Azure Sentinel Analytics "Azure DevOps - Variable Secret Not Secured" query can identify credentials stored in the build process and protect against future credential access by suggesting that they be moved to a secret or stored in KeyVault before they can be accessed by an adversary.
The coverage for these queries is minimal resulting in an overall Minimal score.
References
|
| azure_sentinel | Azure Sentinel | technique_scores | T1552.001 | Credentials In Files |
Comments
The Azure Sentinel Hunting "Query looking for secrets" query can identify potentially malicious database requests for secrets like passwords or other credentials.
The Azure Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can use various modules to search for files containing passwords, but does not address other procedures.
The coverage for these queries is minimal resulting in an overall Minimal score.
References
|
| managed_identities_for_azure_resources | Managed identities for Azure resources | technique_scores | T1552.001 | Credentials In Files |
Comments
This control provides an alternative to hard-coding credentials for accessing Azure services in application code. This control only protects credentials for accessing Azure services and not other credential types, resulting in a Partial coverage score.
References
|