Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1552.001sub-technique of T1552 Unsecured Credentials

Credentials In Files

Containers · IaaS · Linux · macOS · Windows3 pieces on this siteT1552.001 on attack.mitre.org

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

2

Checklists and playbooks to open while the alert is still live.

First-hour playbookMembers

A credential is public

A secret scanner alert, a report from a researcher, or finding a key in a public repository.

T1552.001
First-hour playbookMembers

A malicious package was installed

A registry advisory, a vendor alert or a dependency scanner says a package version you use was malicious, or a build or a developer laptop ran an install script it should not have.

T1552.001

Read

1

Analyses, case studies, guides, references and interview questions.

AnalysisCONSTRUCTED

Evidence Gap Challenge No. 2: the proxy only kept the domain

A developer laptop, a package that should not have been installed, and a proxy that logged where the traffic went but not what was asked for. Work out what the truncation costs you, what you can still prove, and whether a full-URL log would have been worth what it costs to keep.

T1552.001

how MITRE says to see it

Detect Access to Unsecured Credential Files Across Platforms

  • Correlated file access to insecure credential files (e.g., *.env, *.xml, *.ps1) followed by suspicious process execution or authentication using retrieved credentials. Detected through Sysmon logs and Windows Security Event logs.
  • File reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.
  • Terminal-based grep or open of plist/config files containing credentials, correlated with Keychain or system login attempts.
  • Container processes accessing mounted secrets or configuration paths (e.g., /run/secrets, /mnt/config) followed by network access or credential use.

what reduces it

  • M1017 User Training. Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.
  • M1027 Password Policies. Establish an organizational policy that prohibits password storage in files.
  • M1022 Restrict File and Directory Permissions. Restrict file shares to specific directories with access only to necessary users.
  • M1047 Audit. Preemptively search for files containing passwords and take actions to reduce the exposure risk when found.

the rest of T1552

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.