detection.wiki

Unsecured Credentials T1552

Tactic: Credential Access

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Events covered

26 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 10ProcessAccess
SysmonEvent ID 11FileCreate
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
Security-AuditingEvent ID 4624An account was successfully logged on.
Security-AuditingEvent ID 4625An account failed to log on.
Security-AuditingEvent ID 4648A logon was attempted using explicit credentials.
Security-AuditingEvent ID 4656A handle to an object was requested.
Security-AuditingEvent ID 4662An operation was performed on an object.
Security-AuditingEvent ID 4663An attempt was made to access an object.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4690An attempt was made to duplicate a handle to an object.
Security-AuditingEvent ID 5137A directory service object was created.
Security-AuditingEvent ID 5145A network share object was checked to see whether client can be granted desired access.
ESFexecProcess Execution
ESFopenFile Open
ESFcreateFile or Directory Create
ESFwriteFile Write
Linux-AuditdEvent ID 1309EXECVE
CertificateServicesClient-Lifecycle-SystemEvent ID 1007A certificate has been exported.
PowerShellEvent ID 4103Payload Context: ContextInfo User Data: UserData.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
Sysmon-for-LinuxEvent ID 1Process Create
Sysmon-for-LinuxEvent ID 11File created

Authoring guide

These 284 rules share fields, values, and exclusions.

Fields filtered most (202 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType77eq 53, in 26, wildcard 2exec, open, exec_event, start, ProcessRollup2
process_basename52eq 27, in 20, starts_with 7, is_not_null 2, wildcard 1bash, awk, cat, .*, osascript
CommandLine49contains 38, wildcard 8, regex_match 5, in 3, is_not_null 1, match 1 --results=verified, Confluence , Git , ntevent, qe
event.type49eq 46, ne 2, in 1start, access, change, deletion, process_started
Image40ends_with 19, is_not_null 9, wildcard 7, starts_with 5, eq 2, contains 1, \findstr.exe, ./*, /boot/*, /dev/shm/*
TargetFilename35wildcard 23, in 5, contains 4, ends_with 3, starts_with 2, eq 1/Users/*/.electrum/*, /Users/*/Library/Application Support/*/Default/Local..., /Users/*/Library/Application Support/@trezor/*, *AppData\Roaming\Guarda\LocalStorage\leveldb*, *\Appdata\Roaming\Raven\*wallet*
EventID30eq 304688, 4104, 1, 4663, 4662
data_stream.dataset29eq 29aws.cloudtrail, gcp.audit, azure.activitylogs, kubernetes.audit_logs, auditd_manager.auditd
event.outcome25eq 25success, Success, failure
process.args25in 13, wildcard 11, eq 9, contains 6, starts_with 2, ends_with 1, regex_match 1*/.azure/*, */.config/gcloud/*, /bin/awk, *socat *, * --output*
event.category18eq 15, in 3file, process, registry, network
OriginalFileName16eq 16FINDSTR.EXE, FIND.EXE, reg.exe, wevtutil.exe, wmic.exe
file.name11wildcard 8, eq 2, in 1, ne 1Cookies, Cookies.binarycookies, Login Data, cert?.db, cookies.sqlite
src_ip10is_not_null 10
ScriptBlockText9contains 6, eq 2, in 2 -R, *Get-AdComputer*, *export-certificate*, *export-pfxcertificate*, *ms-Mcs-AdmPwd*

Top indicator values (2640 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
331036
event.typeeq
access
79
EventTypeeq
open
1749
EventTypeeq
exec
13547
event.outcomeeq
Success
16306
EventTypein
exec
11180
EventTypein
start
10157
EventTypein
exec_event
7135
EventTypein
ProcessRollup2
5119
src_ipis_not_null
1069
Imageis_not_null
9155
OriginalFileNameeq
FINDSTR.EXE
812
EventIDeq
4688
7284
EventIDeq
4104
6269
ServiceNameeq
k8s.io
728
data_stream.dataseteq
gcp.audit
760
data_stream.dataseteq
aws.cloudtrail
6143
file.namewildcard
cookies.sqlite
711
file.namewildcard
key?.db
711
file.namewildcard
logins.json
711
process_basenamestarts_with
python*
738
process_idne
4
744
container.idwildcard
*
626
process_basenamein
cat
622
Imageends_with
\findstr.exe
511
TargetFilenamewildcard
/Users/*/.electrum/*
55
TargetFilenamewildcard
/Users/*/Library/Application Support/*/Default/Local Extension Settings/*
55
TargetFilenamewildcard
/Users/*/Library/Application Support/@trezor/*
55
TargetFilenamewildcard
/Users/*/Library/Application Support/Atomic/*
55
TargetFilenamewildcard
/Users/*/Library/Application Support/Bitcoin/*
55

Exclusions (774 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Imagewildcard
?:\Windows\explorer.exe
7
Imagewildcard
?:\Program Files (x86)\*
5
Imagewildcard
?:\Program Files\*
5
Imagewildcard
?:\Windows\System32\SearchProtocolHost.exe
5
Imagewildcard
?:\Windows\System32\cmd.exe
5
Imagewildcard
?:\Windows\System32\dllhost.exe
5
Imagewildcard
?:\ProgramData\Microsoft\Windows Defender\Platform\*\MpCopyAccelerator.exe
4
Imagewildcard
?:\ProgramData\Microsoft\Windows Defender\Platform\*\MsMpEng.exe
4
Imagewildcard
?:\Users\*\AppData\Local\Microsoft\OneDrive\OneDrive.exe
4
Imagewildcard
?:\Windows\System32\Robocopy.exe
4
Imagewildcard
?:\Program Files (x86)\*.exe
3
process.code_signature.trustedeq
true
7
src_ipin
127.0.0.1
5
src_ipin
::1
5
user.ideq
S-1-5-18
5

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 55 rules

Elastic 123 rules

Splunk 47 rules

Kusto 23 rules

YARA-L 6 rules

Panther 30 rules