Skip to content

T1552.001 Credentials In Files

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping.1 Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.5

In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.2 They may also be found as parameters to deployment commands in container logs.3 In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.4

Item Value
ID T1552.001
Sub-techniques T1552.001, T1552.002, T1552.003, T1552.004, T1552.005, T1552.006, T1552.007, T1552.008
Tactics TA0006
Platforms Containers, IaaS, Linux, Windows, macOS
Version 1.3
Created 04 February 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S0677 AADInternals AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine.10
S0331 Agent Tesla Agent Tesla has the ability to extract credentials from configuration or support files.17
G0022 APT3 APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.35
G0064 APT33 APT33 has used a variety of publicly available tools like LaZagne to gather credentials.2930
S0344 Azorult Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.18
S0089 BlackEnergy BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.2425
G1003 Ember Bear Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.44
S0367 Emotet Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user. 1415
S0363 Empire Empire can use various modules to search for files containing passwords.9
G1016 FIN13 FIN13 has obtained administrative credentials by browsing through local files on a compromised machine.33
G0117 Fox Kitten Fox Kitten has accessed files to gain valid credentials.31
S0601 Hildegard Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.2
G0119 Indrik Spider Indrik Spider has searched files to obtain and exfiltrate credentials.34
S0283 jRAT jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.26
G0094 Kimsuky Kimsuky has used tools that are capable of obtaining credentials from saved mail.37
S0349 LaZagne LaZagne can obtain credentials from chats, databases, mail, and WiFi.8
G0077 Leafminer Leafminer used several tools for retrieving login and password information, including LaZagne.36
C0049 Leviathan Australian Intrusions Leviathan gathered credentials stored in files related to Building Management System (BMS) operations during Leviathan Australian Intrusions.57
G0069 MuddyWater MuddyWater has run a tool that steals passwords saved in victim email.48
G0049 OilRig OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.43414240
S0067 pngdowner If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.23
S0378 PoshC2 PoshC2 contains modules for searching for passwords in local and remote files.7
S0192 Pupy Pupy can use Lazagne for harvesting credentials.6
S0583 Pysa Pysa has extracted credentials from the password database before encrypting the files.19
S0262 QuasarRAT QuasarRAT can obtain passwords from FTP clients.1112
G1039 RedCurl RedCurl used LaZagne to obtain passwords in files.3839
G1015 Scattered Spider Scattered Spider Spider searches for credential storage documentation on a compromised host.505149
C0058 SharePoint ToolShell Exploitation During SharePoint ToolShell Exploitation, threat actors accessed web.config and machine.config to extract MachineKey values, enabling them to forge legitimate VIEWSTATE tokens for future deserialization payloads.5553525456
S0226 Smoke Loader Smoke Loader searches for files named logins.json to parse for credentials.16
S1183 StrelaStealer StrelaStealer searches for and if found collects the contents of files such as logins.json and key4.db in the $APPDATA%\Thunderbird\Profiles\ directory, associated with the Thunderbird email application.2728
G0092 TA505 TA505 has used malware to gather credentials from FTP clients and Outlook.32
G0139 TeamTNT TeamTNT has searched for unsecured AWS credentials and Docker API credentials.454746
S0266 TrickBot TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP.2021 Additionally, it searches for the “.vnc.lnk” affix to steal VNC credentials.22
S0117 XTunnel XTunnel is capable of accessing locally stored passwords on victims.13

Mitigations

ID Mitigation Description
M1047 Audit Preemptively search for files containing passwords and take actions to reduce the exposure risk when found.
M1027 Password Policies Establish an organizational policy that prohibits password storage in files.
M1022 Restrict File and Directory Permissions Restrict file shares to specific directories with access only to necessary users.
M1017 User Training Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.

References

  1. CG. (2014, May 20). Mimikatz Against Virtual Machine Memory Part 1. Retrieved November 12, 2014. ↩

  2. Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. ↩↩

  3. Chen, J.. (2020, January 29). Attacker’s Tactics and Techniques in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021. ↩

  4. Maddalena, C.. (2018, September 12). Head in the Clouds. Retrieved October 4, 2019. ↩

  5. Security Research and Defense. (2014, May 13). MS14-025: An Update for Group Policy Preferences. Retrieved January 28, 2015. ↩

  6. Nicolas Verdier. (n.d.). Retrieved January 29, 2018. ↩

  7. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  8. Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018. ↩

  9. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. ↩

  10. Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022. ↩

  11. MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018. ↩

  12. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018. ↩

  13. Belcher, P.. (2016, July 28). Tunnel of Gov: DNC Hack and the Russian XTunnel. Retrieved August 3, 2016. ↩

  14. US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019. ↩

  15. CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019. ↩

  16. Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018. ↩

  17. Walter, J. (2020, August 10). Agent Tesla | Old RAT Uses New Tricks to Stay on Top. Retrieved December 11, 2020. ↩

  18. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018. ↩

  19. CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021. ↩

  20. Anthony, N., Pascual, C.. (2018, November 1). Trickbot Shows Off New Trick: Password Grabber Module. Retrieved November 16, 2018. ↩

  21. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020. ↩

  22. Llimos, N., Pascual, C.. (2019, February 12). Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire. Retrieved March 12, 2019. ↩

  23. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016. ↩

  24. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016. ↩

  25. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016. ↩

  26. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019. ↩

  27. DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024. ↩

  28. Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024. ↩

  29. Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019. ↩

  30. Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019. ↩

  31. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩

  32. Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019. ↩

  33. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023. ↩

  34. Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024. ↩

  35. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016. ↩

  36. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018. ↩

  37. ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019. ↩

  38. Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024. ↩

  39. Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024. ↩

  40. Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019. ↩

  41. Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017. ↩

  42. Mandiant. (2018). Mandiant M-Trends 2018. Retrieved November 17, 2024. ↩

  43. Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023. ↩

  44. US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024. ↩

  45. Cado Security. (2020, August 16). Team TNT – The First Crypto-Mining Worm to Steal AWS Credentials. Retrieved September 22, 2021. ↩

  46. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022. ↩

  47. Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021. ↩

  48. Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018. ↩

  49. Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025. ↩

  50. CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024. ↩

  51. Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025. ↩

  52. Trend Micro Research. (2022, July 22). Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771). Retrieved October 15, 2025. ↩

  53. Eye Security. (2025, July 19). SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704). Retrieved October 15, 2025. ↩

  54. Kenin, S. et al. (2025, July 21). SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers. Retrieved October 15, 2025. ↩

  55. Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025. ↩

  56. Unit 42. (2025, July 31). Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated). Retrieved October 15, 2025. ↩

  57. CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025. ↩