Unsecured Credentials

ID: T1552
Tactics: TA0006 Credential Access
Platforms: Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider
Data sources: File Creation, Process Creation, Windows Registry Key Modification, File Access, Command Execution, User Account Authentication, Application Log Content, Cloud Service Metadata, Network Traffic Content
Source: attack.mitre.org
MITRE last modified: 25 Oct 2025

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).^[5]

Sub-techniques (8)

Detection

DET0412 Detect Access or Search for Unsecured Credentials Across Platforms
Data components: File Creation, Process Creation, Windows Registry Key Modification, File Access, Command Execution, User Account Authentication, Application Log Content, Cloud Service Metadata, Network Traffic Content

Mitigations (11)

M1015 Active Directory Configuration: Remove vulnerable Group Policy Preferences.^[1]
M1017 User Training: Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.
M1022 Restrict File and Directory Permissions: Restrict file shares to specific directories with access only to necessary users.
M1026 Privileged Account Management: If it is necessary that software must store credentials in the Registry, then ensure the associated accounts have limited permissions so they cannot be abused if obtained by an adversary.
M1027 Password Policies: Use strong passphrases for private keys to make cracking difficult. Do not store credentials within the Registry. Establish an organizational policy that prohibits password storage in files.
M1028 Operating System Configuration: There are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands:
set +o history and set -o history to start logging again;
unset HISTFILE being added to a user's .bash_rc file; and
ln -s /dev/null ~/.bash_history to write commands to /dev/nullinstead.
M1035 Limit Access to Resource Over Network: Limit network access to sensitive services, such as the Instance Metadata API.
M1037 Filter Network Traffic: Limit access to the Instance Metadata API. A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.^[2]
M1041 Encrypt Sensitive Information: When possible, store keys on separate cryptographic hardware instead of on the local system.
M1047 Audit: Preemptively search for files containing passwords or other credentials and take actions to reduce the exposure risk when found.
M1051 Update Software: Apply patch KB2962486 which prevents credentials from being stored in GPPs.^[3]^[4]

Groups (2)

Software (4)

References

Microsoft MS14-025
RedLock Instance Metadata API 2018
ADSecurity Finding Passwords in SYSVOL
MS14-025
Brining MimiKatz to Unix