CyberStack

MITRE ATT&CK / Techniques / T1552.001

Unsecured Credentials: Credentials In Files

ID
T1552.001
Tactics
TA0006 Credential Access
Sub-technique of
T1552 Unsecured Credentials
Platforms
Containers, IaaS, Linux, macOS, Windows
Data sources
File Creation, Process Creation, Logon Session Creation, File Access, Command Execution, Network Connection Creation
Source
attack.mitre.org
MITRE last modified
12 Sep 2026

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping.[1] Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.[2]

In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.[3] They may also be found as parameters to deployment commands in container logs.[4] In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.[5]

Detection

Mitigations (4)

M1017 User Training

Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.

M1022 Restrict File and Directory Permissions

Restrict file shares to specific directories with access only to necessary users.

M1027 Password Policies

Establish an organizational policy that prohibits password storage in files.

M1047 Audit

Preemptively search for files containing passwords and take actions to reduce the exposure risk when found.

Groups (16)

Software (25)

References

  1. CG 2014
  2. SRD GPP
  3. Unit 42 Hildegard Malware
  4. Unit 42 Unsecured Docker Daemons
  5. Specter Ops - Cloud Credential Storage