Detection coverage in DCV across AWS, Azure and GCP for Unsecured Credentials: Credentials In Files, plus the corresponding Sigma rules in the CloudSigma library. Source data refreshed 2026-04-24.
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.
In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files. They may also be found as parameters to deployment commands in container logs. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.
Platforms: Containers, IaaS, Linux, macOS, Windows.
DCV maps 57 detections across 2 cloud providers to T1552.001. Coverage by source:
| Source | Cloud | Findings mapped | Avg confidence |
|---|---|---|---|
| AWS Config Rules | AWS | 22 | 0.65 |
| Azure Policy | Azure | 11 | 0.89 |
| Microsoft Defender for Cloud | Azure | 11 | 0.90 |
| AWS GuardDuty | AWS | 8 | 0.85 |
| AWS Macie | AWS | 4 | 0.91 |
| Azure Regulatory Compliance | Azure | 1 | 0.90 |
CloudSigma ships 3 production-ready Sigma rules that detect T1552.001 across 3 platforms. Every rule below is validated against its source SIEM dialect before publication.
High-fidelity detection of T1552.001 requires correlation
across multiple events. For example, a credential-validation call
followed by a reconnaissance chain (List* /
Describe*) within a short window from an unfamiliar
source. A single-event Sigma rule on
GetCallerIdentity alone fires constantly on
legitimate CLI, SDK and CI/CD activity.
Where you have a specific advisory, vulnerability disclosure or blog post that exercises T1552.001-style abuse, CloudSigma can generate a starting-point rule from that input. You then deploy it in your SIEM and combine it with the SIEM's native correlation features (timeframe joins across users, source-IP anomalies, impossible-travel checks). For T1552.001 specifically the generated rule is rarely sufficient on its own; pair it with the SIEM-side correlation logic before enabling in production.