Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1552

Unsecured Credentials

Windows · SaaS · IaaS · Linux · macOS · Containers · Network Devices · Office Suite · Identity Provider3 pieces on this siteT1552 on attack.mitre.org

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

2

Checklists and playbooks to open while the alert is still live.

First-hour playbookMembers

A credential is public

A secret scanner alert, a report from a researcher, or finding a key in a public repository.

T1552.001
First-hour playbookMembers

A malicious package was installed

A registry advisory, a vendor alert or a dependency scanner says a package version you use was malicious, or a build or a developer laptop ran an install script it should not have.

T1552.001

Read

1

Analyses, case studies, guides, references and interview questions.

AnalysisCONSTRUCTED

Evidence Gap Challenge No. 2: the proxy only kept the domain

A developer laptop, a package that should not have been installed, and a proxy that logged where the traffic went but not what was asked for. Work out what the truncation costs you, what you can still prove, and whether a full-URL log would have been worth what it costs to keep.

T1552.001

how MITRE says to see it

Detect Access or Search for Unsecured Credentials Across Platforms

  • Unusual access to bash history, registry credentials paths, or private key files by unauthorized or scripting tools, with correlated file and process activity.
  • Reading of sensitive files like.bash_history, /etc/shadow, or private key directories by unauthorized users or unusual processes.
  • Unusual access to ~/Library/Keychains, ~/.bash_history, or Terminal command history by unauthorized processes or users.
  • Unusual web-based access or API scraping of password managers, single sign-on sessions, or credential sync services via browser automation or anomalous API tokens.

what reduces it

  • M1035 Limit Access to Resource Over Network. Limit network access to sensitive services, such as the Instance Metadata API.
  • M1037 Filter Network Traffic. Limit access to the Instance Metadata API. A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.
  • M1017 User Training. Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.
  • M1028 Operating System Configuration. There are multiple methods of preventing a user's command history from being flushed to their.bash_history file, including use of the following commands: `set +o history` and `set -o history` to start logging again; `unset HISTFILE` being added to a user's.bash_rc file; and `ln -s /dev/null ~/.bash_history` to write commands to `/dev/null`instead.
  • M1027 Password Policies. Use strong passphrases for private keys to make cracking difficult. Do not store credentials within the Registry. Establish an organizational policy that prohibits password storage in files.
  • M1022 Restrict File and Directory Permissions. Restrict file shares to specific directories with access only to necessary users.

sub-techniques

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.