Applied Cybernetics Group
T1552 Unsecured Credentials
- Technique
T1552- Tactics
- Credential Access
- Research, 90 days
- 2
- KEV CVEs mapped
- 4
- SigmaHQ rules
- 13
- Elastic, Splunk
- 120
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1552
MITRE description
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-21Flare: Measuring Credential Exposure of Contractors and Integrators After the Refrigeration System Attack in France: 601 Industrial Remote Access Addresses Recovered From Stealer Logs, 73% on the Largest Platform Paired With Device Credentials -
2026-09-16Datadog Security Labs: Mapping out your unknown: A threat hunter’s guide to GitHub
Detection coverage
SigmaHQ community rules
- EventLog Query Requests By Builtin Utilities (threat-hunting)
- Kubernetes Admission Controller Modification (core)
- Azure Keyvault Key Modified or Deleted (core)
- Azure Key Vault Modified or Deleted (core)
- Azure Keyvault Secrets Modified or Deleted (core)
- Azure Kubernetes Admission Controller (core)
- Application AppID Uri Configuration Changes (core)
- Added Owner To Application (core)
- Google Cloud Kubernetes Admission Controller (core)
- Potential Okta Password in AlternateID Field (core)
- Script Interpreter Spawning Credential Scanner - Linux (core)
- Potentially Suspicious EventLog Recon Activity Using Log Query Utilities (core)
- Script Interpreter Spawning Credential Scanner - Windows (core)
Elastic and Splunk rules
- Azure WireServer Unusual Process Connection (elastic)
- GenAI Process Accessing Sensitive Files (elastic)
- Potential Secret Scanning via Gitleaks (elastic)
- Potential Credential Discovery via Recursive Grep (elastic)
- Multi-Cloud CLI Token and Credential Access Commands (elastic)
- Multiple Credential Access by VS Code or Cursor IDE Descendant (elastic)
- Package Runtime Secret File Access Followed by IMDS Request (elastic)
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution (elastic)
- Suspicious Instance Metadata Service (IMDS) API Request (elastic)
- Credential Access via TruffleHog Execution (elastic)
- Web Server Cloud Metadata SSRF Request (elastic)
- Potential Impersonation Attempt via Kubectl (elastic)
- Kubectl Secrets Enumeration Across All Namespaces (elastic)
- Web Server Local File Inclusion Activity (elastic)
- Service Account Token or Certificate Access Followed by Kubernetes API Request (elastic)
- Kubernetes Direct API Request via Curl or Wget (elastic)
- Web Server Potential Command Injection Request (elastic)
- AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role (elastic)
- AWS Cognito Unauthenticated Identity Pool Credentials Issued (elastic)
- AWS S3 Credential File Retrieved from Bucket (elastic)
- AWS IAM CompromisedKeyQuarantine Policy Attached to User (elastic)
- AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts (elastic)
- AWS IAM Long-Term Access Key First Seen from Source IP (elastic)
- AWS EKS Rapid Secret GET Activity Against Multiple Objects (elastic)
- AWS EKS Pod Exec Cloud Instance Metadata Access (elastic)
Showing 25 of 120.