T1552 · Unsecured Credentials

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1552 · Unsecured Credentials · Sunturai

attack-patternenterprise-attackT1552

Unsecured Credentials

attack-pattern--435dfb86-2697-4867-85b5-2fef496c0517

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).(Citation: Brining MimiKatz to Unix)

Created: Feb 4, 2020, 12:47 PM UTC
Modified: Oct 24, 2025, 5:48 PM UTC

8 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

165 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Kubernetes Service Account Token Created via TokenRequest API	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
GCP Vertex AI Prompt or Response Containing Credentials	High	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
AWS EC2 Instance Console Login via Assumed Role	High	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
AWS IAM CompromisedKeyQuarantine Policy Attached to User	High	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Access to a Sensitive LDAP Attribute	Medium	Elastic detection rules	Oct 7, 2026	Elastic License 2.0
Theom - Dev secrets unencrypted	High	Microsoft Sentinel analytics	Oct 6, 2026	MIT License
Microsoft Foundry Prompt or Completion Containing Credentials	High	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
First Time Python Accessed Sensitive Credential Files	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata	High	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
AWS Bedrock AgentCore Runtime Prompt Containing Credentials	High	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
AWS Bedrock Model Prompt or Completion Containing Credentials	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
AWS Bedrock AgentCore Execution Role Used Outside Its Runtime	High	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
GenAI Process Accessing Sensitive Files	High	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
AWS GuardDuty - EKS privilege escalation and credential access	Unknown	Microsoft Sentinel analytics	Sep 23, 2026	MIT License
Windows Unsecured Outlook Credentials Access In Registry	Informational	Splunk security content	Sep 22, 2026	Apache License 2.0
Potential PowerShell HackTool Script by Function Names	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Command Shell Activity Started via RunDLL32	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious CertUtil Commands	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Wireless Credential Dumping using Netsh Command	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Web Config File Access	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Protected Storage Service Access via SMB	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Microsoft IIS Connection Strings Decryption	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Microsoft IIS Service Account Password Dumped	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Creation or Modification of Domain Backup DPAPI private key	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Cloud Instance Metadata Credential Path HTTP Request	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 165

Filter in the catalogue

External references

mitre-attackT1552Open reference

Brining MimiKatz to UnixOpen reference

Platforms

ContainersIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

Kill chain phases

credential-access

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object