- Tactics
- Credential Access
- Platforms
- Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider
- Reference
- attack.mitre.org/techniques/T1552
Description
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).(Citation: Brining MimiKatz to Unix)
Sub-techniques
How GTK Cyber trains on this
GTK Cyber's Threat Hunting with Data Science course teaches you to build machine-learning detections for techniques like this across the MITRE ATT&CK framework, including the Credential Access tactic this technique falls under. Practitioner-led, focused on real detections, not memorizing technique IDs.
Related techniques
- T1003 — OS Credential Dumping
- T1040 — Network Sniffing
- T1056 — Input Capture
- T1110 — Brute Force
- T1111 — Multi-Factor Authentication Interception
- T1187 — Forced Authentication
- T1212 — Exploitation for Credential Access
- T1528 — Steal Application Access Token
- T1539 — Steal Web Session Cookie
- T1555 — Credentials from Password Stores
- T1556 — Modify Authentication Process
- T1557 — Adversary-in-the-Middle