t1552-unsecured-credentials

name	T1552_unsecured-credentials
description	Adversaries may search compromised systems to find and obtain insecurely stored credentials.
category	authentication
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1552","credential-access","windows","saas","iaas","linux","macos","containers","network-devices","office-suite","identity-provider"]
technique_id	T1552
tactic	credential-access
all_tactics	["credential-access"]
platforms	["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider"]
mitre_url	https://attack.mitre.org/techniques/T1552
tech_stack	["windows","saas","cloud","linux","macos","containers","network devices","office","identity"]
cwe_ids	["CWE-522"]
chains_with	["T1552.001","T1552.002","T1552.003","T1552.004","T1552.005","T1552.006","T1552.007","T1552.008"]
prerequisites	[]
severity_boost	{"T1552.001":"Chain with T1552.001 for deeper attack path","T1552.002":"Chain with T1552.002 for deeper attack path","T1552.003":"Chain with T1552.003 for deeper attack path"}

T1552 Unsecured Credentials

High-Level Description

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Kill Chain Phase

• Credential Access (TA0006)

Platforms: Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider

What to Check

• Identify if Unsecured Credentials technique is applicable to target environment
• Check Windows systems for indicators of Unsecured Credentials
• Check SaaS systems for indicators of Unsecured Credentials
• Check IaaS systems for indicators of Unsecured Credentials
• Verify mitigations are bypassed or absent (11 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: AWS - Retrieve EC2 Password Data using stratus

This atomic runs an API call GetPasswordData from a role that does not have permission to do so. This simulates an attacker attempting to retrieve RDP passwords on a high number of Windows EC2 instances. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/

Supported Platforms: linux, macos, iaas:aws

export AWS_REGION=#{aws_region}
cd #{stratus_path}
echo 
./stratus warmup aws.credential-access.ec2-get-password-data
 
./stratus detonate aws.credential-access.ec2-get-password-data --force