T1552.001 — Credentials In Files

Tactic: Credential Access · Platforms: Containers, IaaS, Linux, macOS, Windows

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or…

Sub-technique of Unsecured Credentials (T1552).

Sigma detection rules (5)

T1552.001 Unsecured Credentials: Credentials In Files

title: "T1552.001 Unsecured Credentials: Credentials In Files"
id: 98a1522f-1c48-4793-82ee-25553c190c73
description: 'Detects creation of files whose names match common insecurely stored credential artifacts (SSH private keys, unattended-install answer files, web/app config files, password vaults, .env files), consistent with adversaries staging, exporting, or dropping tooling output containing credential material found on the file system. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: FileNamePattern, ProcessAccessScope, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1552/001
author: Shahrukh Khan
date: 2026-05-21
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.001

logsource:
  category: file_event
  product: windows

detection:
  selection:
    EventID: 11
    TargetFilename|contains:
      - 'id_rsa'
      - 'id_dsa'
      - '\Unattend.xml'
      - '\web.config'
      - '.kdbx'
      - '.env'
      - 'credentials.xml'
      - 'password'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate deployment, backup, or development tooling creating or copying files that match these name patterns; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with path allowlists if noise remains.

level: medium

T1552.001 Unsecured Credentials: Credentials In Files

title: "T1552.001 Unsecured Credentials: Credentials In Files"
id: 555676c6-436c-4170-8c9f-f6b45c22e287
description: 'Detect Access to Unsecured Credential Files Across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Matches the credential-shaped keyword against argv positions a1 through a3 instead of assuming it always lands in a1, since leading flags on grep (-r, -n, -i) or a find search-path in a1 shift the keyword to a later position. Tune using: RegexPatterns, UserContextScope, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1552/001
author: Shahrukh Khan
date: 2026-06-10
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_base:
    type: EXECVE
    a0|endswith:
      - '/grep'
      - '/find'
  selection_keyword:
    - a1|contains:
        - 'password'
        - 'id_rsa'
        - 'BEGIN RSA PRIVATE KEY'
    - a2|contains:
        - 'password'
        - 'id_rsa'
        - 'BEGIN RSA PRIVATE KEY'
    - a3|contains:
        - 'password'
        - 'id_rsa'
        - 'BEGIN RSA PRIVATE KEY'

  condition: selection_base and selection_keyword

falsepositives:
  - Developers legitimately grepping their own codebase/configs for known keywords during troubleshooting; scope UserContextScope to accounts that don't normally have reason to bulk-search for credential-shaped strings.

level: medium

T1552.001 Unsecured Credentials: Credentials In Files

title: "T1552.001 Unsecured Credentials: Credentials In Files"
id: 7d181fab-13a9-4e92-b00e-5a94186e7a4b
description: 'Detect Access to Unsecured Credential Files Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: KeychainToolAccess, FileTypeList.'
references:
  - https://attack.mitre.org/techniques/T1552/001
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.001

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/grep'
      - '/find'
      - '/cat'
  selection_ext:
    CommandLine|contains:
      - '.pem'
      - '.p12'
      - '.key'
      - 'credentials'
      - 'config.json'
  condition: selection and selection_ext

falsepositives:
  - Build tools and configuration management scripts read the same credential file types during normal operation, so this should be scoped to invocations from unusual parent processes such as script interpreters spawned by a downloaded file.

level: medium

T1552.001 Unsecured Credentials: Credentials In Files

title: "T1552.001 Unsecured Credentials: Credentials In Files"
id: 7410a02d-2d11-4fe1-847e-3833e61c9367
description: 'Detect grep/find targeting known credential-file paths and extensions (.ssh/id_rsa, .aws/credentials, .netrc, .env, .git-credentials, .pgpass, .pem, .key) rather than bare password/secret keyword greps, which are indistinguishable from routine developer or audit activity. (Data Component: File Access; baseline tier: fallback.) Tune using: CredentialFilePattern, RoleAssumptionScope, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1552/001
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_grep:
    type: EXECVE
    a0|endswith: '/grep'
  selection_grep_paths:
    - a1|contains:
        - '.ssh/id_rsa'
        - '.aws/credentials'
        - '.netrc'
        - '.env'
        - '.git-credentials'
        - '.pgpass'
    - a2|contains:
        - '.ssh/id_rsa'
        - '.aws/credentials'
        - '.netrc'
        - '.env'
        - '.git-credentials'
        - '.pgpass'
  selection_find:
    type: EXECVE
    a0|endswith: '/find'
    a1|contains:
      - '.pem'
      - '.key'
      - '.env'
      - 'id_rsa'
      - '.netrc'
      - 'credentials'

  condition: (selection_grep and selection_grep_paths) or selection_find

falsepositives:
  - Backup, config-management, or credential-rotation tooling that legitimately reads or searches these credential file paths as part of automated workflows.

level: high

T1552.001 Unsecured Credentials: Credentials In Files

title: "T1552.001 Unsecured Credentials: Credentials In Files"
id: bf188a95-e66b-4923-bcc5-7e901d2e0284
description: 'Detect Access to Unsecured Credential Files Across Platforms. Restricted nametype from [NORMAL, CREATE] to NORMAL only: including CREATE conflated the technique''s actual behavior of searching/reading pre-existing credential files with the unrelated act of a new file being written, which produced false matches whenever a credential-adjacent file was simply created rather than read. (Data Component: File Access; baseline tier: fallback.) Tune using: SecretMountPaths, ProcessBaselineDeviation.'
references:
  - https://attack.mitre.org/techniques/T1552/001
author: Shahrukh Khan
date: 2026-05-17
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.001

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    nametype: NORMAL
    name|contains:
      - '/.ssh/id_rsa'
      - '/.aws/credentials'
      - '/.netrc'
      - '/.env'
      - 'passwd'
      - 'shadow'

  condition: selection

falsepositives:
  - This rule was reclassified from network_connection to file_event because auditd captures credential file access via PATH records, not network sockets; routine reads by configuration management tools, backup jobs, or credential managers can trigger this.

level: medium

Related sub-techniques

Explore