Unsecured Credentials

What is Unsecured Credentials?

“Unsecured Credentials is documented as technique T1552 in MITRE ATT&CK® v19.1 under the Credential Access tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Unsecured Credentials activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for execution of tools and commands that search for credential patterns in files, including grep and findstr commands targeting keywords like password, passwd, secret, token, and api_key across file system paths.

2. 2

   Alert on access to CI/CD configuration files, Docker environment files, Kubernetes secrets, and cloud provider credential files from processes other than the legitimate application or administrator tools that normally access them.

3. 3

   Detect access to shell history files including ~/.bash_history, ~/.zsh_history, and PowerShell history files from processes that are not interactive shell sessions, as these may contain previously executed commands with credentials.

4. 4

   Monitor cloud environment credential files in default locations such as ~/.aws/credentials, ~/.azure/credentials, and service account key files, alerting on access from processes other than authorized cloud CLI tools.

5. 5

   Implement secrets scanning in source code repositories and alert on commits or repository access that retrieves files containing credential patterns, particularly access to repository history that may contain previously removed credentials.

Example Alerts

These realistic alert examples show what Unsecured Credentials looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Unsecured Credentials?

Detection centers on XDR, SIEM telemetry for the credential access phase of the attack. Monitor for execution of tools and commands that search for credential patterns in files, including grep and findstr commands targeting keywords like password, passwd, secret, token, and api_key across file system paths. Alert on access to CI/CD configuration files, Docker environment files, Kubernetes secrets, and cloud provider credential files from processes other than the legitimate application or administrator tools that normally access them.

What does a Unsecured Credentials alert look like?

A representative XDR detection is "Credential Search Pattern in Configuration Files" (high severity): PowerShell command executed searching for credential patterns: Get-ChildItem -Recurse | Select-String -Pattern "password=|passwd=|pwd=" targeted at C:\inetpub\, C:\Program Files\, and shared network drives. The search returned 47 configuration files containing plaintext credentials for database connections, API services, and remote management interfaces. These credentials were subsequently accessed and compiled into a single file.

Which tools detect Unsecured Credentials, and how can I practice?

Unsecured Credentials (T1552) is best surfaced with XDR, SIEM telemetry, which exposes the credential access signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.