MITRE ATT&CK · TA0006 Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Detection coverage in DCV across AWS, Azure and GCP for Unsecured Credentials: Credentials In Files, plus the corresponding Sigma rules in the CloudSigma library. Source data refreshed 2026-04-24.

01 What is T1552.001?

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.

In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files. They may also be found as parameters to deployment commands in container logs. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.

Platforms: Containers, IaaS, Linux, macOS, Windows.

02 Coverage in DCV

DCV maps 57 detections across 2 cloud providers to T1552.001. Coverage by source:

Source Cloud Findings mapped Avg confidence
AWS Config Rules AWS 22 0.65
Azure Policy Azure 11 0.89
Microsoft Defender for Cloud Azure 11 0.90
AWS GuardDuty AWS 8 0.85
AWS Macie AWS 4 0.91
Azure Regulatory Compliance Azure 1 0.90
03 Detect with CloudSigma

CloudSigma ships 3 production-ready Sigma rules that detect T1552.001 across 3 platforms. Every rule below is validated against its source SIEM dialect before publication.

High-fidelity detection of T1552.001 requires correlation across multiple events. For example, a credential-validation call followed by a reconnaissance chain (List* / Describe*) within a short window from an unfamiliar source. A single-event Sigma rule on GetCallerIdentity alone fires constantly on legitimate CLI, SDK and CI/CD activity.

Where you have a specific advisory, vulnerability disclosure or blog post that exercises T1552.001-style abuse, CloudSigma can generate a starting-point rule from that input. You then deploy it in your SIEM and combine it with the SIEM's native correlation features (timeframe joins across users, source-IP anomalies, impossible-travel checks). For T1552.001 specifically the generated rule is rarely sufficient on its own; pair it with the SIEM-side correlation logic before enabling in production.

04 Related techniques
Sources
  • MITRE ATT&CK, https://attack.mitre.org/techniques/T1552/001/
  • MITRE Tactic TA0006 Credential Access, https://attack.mitre.org/tactics/TA0006/
  • MITRE Center for Threat-Informed Defense, Security Stack Mappings (https://center-for-threat-informed-defense.github.io/security-stack-mappings/)
Last verified: 2026-04-24