Last reviewed:
T1552.001 is the credential-discovery technique of harvesting credentials from filesystems and cloud-resident storage: keys in environment files, hardcoded secrets, AWS profile blobs, .git directories. DCV maps a broad control set to T1552.001, with GCP SCC's SERVICE_ACCOUNT_KEY_EXPOSED as the most distinctive signal: it specifically flags key material detected in public repositories or logs. The remediation template wires Secrets Manager rotation policies and CodeBuild environment-variable scanning. T1552.001 is a discipline gap as much as a detection gap.
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.
In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files. They may also be found as parameters to deployment commands in container logs. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.
Platforms: Containers, IaaS, Linux, macOS, Windows.
DCV maps 57 detections across 2 cloud providers to T1552.001. Coverage by source:
| Source | Cloud | Findings mapped | Avg confidence |
|---|---|---|---|
| AWS Config Rules | AWS | 22 | 0.65 |
| Azure Policy | Azure | 11 | 0.89 |
| Microsoft Defender for Cloud | Azure | 11 | 0.90 |
| AWS GuardDuty | AWS | 8 | 0.85 |
| AWS Macie | AWS | 4 | 0.91 |
| Azure Regulatory Compliance | Azure | 1 | 0.90 |
CloudSigma has coverage metadata for 57 T1552.001 rules across 3 platforms. The linked platform page remains the canonical rule surface; this page will embed an example after a rule clears the public embed bar.
CloudSigma has coverage metadata for T1552.001, but no public example rule clears the embed bar for this page yet. Generate a fresh starting-point rule in CloudSigma from the relevant advisory or threat-research input, then validate it against your local telemetry before enabling it in production.
T1552.001 is the credential-discovery technique of harvesting credentials from filesystems and cloud-resident storage: keys in environment files, hardcoded secrets, AWS profile blobs, .git directories. DCV maps a broad control set to T1552.001, with GCP SCC's SERVICE_ACCOUNT_KEY_EXPOSED as the most distinctive signal: it specifically flags key material detected in public repositories or logs. The remediation template wires Secrets Manager rotation policies and CodeBuild environment-variable scanning. T1552.001 is a discipline gap as much as a detection gap.
DCV maps 57 cloud-native detections to T1552.001 across 2 cloud providers, drawn from AWS Config Rules, AWS GuardDuty, AWS Macie, Azure Policy, Azure Regulatory Compliance and Microsoft Defender for Cloud.
T1552.001 is part of MITRE ATT&CK TA0006 Credential Access: How adversaries steal credentials, account names and passwords.
CloudSigma ships 3 validated Sigma rules for T1552.001 across AWS CloudTrail, Azure Activity and GCP Audit Logs. Each rule is validated against its source SIEM dialect before publication.