T1552

Unsecured Credentials

Credential Access Last updated:

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files, operating system or application-specific repositories, shell history files, private key files, cloud instance metadata APIs, container environment variables, and group policy preference files. Tools like LaZagne, NirSoft utilities, and custom scripts are commonly used to automate credential harvesting across multiple storage locations simultaneously.

What is T1552 Unsecured Credentials?

Unsecured Credentials (T1552) maps to the Credential Access tactic — the adversary is trying to steal account names and passwords in MITRE ATT&CK.

This page provides production-ready detection logic for Unsecured Credentials, covering the data sources and telemetry it touches: File: File Access, Process: Process Creation, Windows Registry: Windows Registry Key Access, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Credential Access
Technique
T1552 Unsecured Credentials
Canonical reference
https://attack.mitre.org/techniques/T1552/
Microsoft Sentinel / Defender
kusto 
let CredentialFilePatterns = dynamic([
  "password", "passwd", "credentials", "creds", "secret", "apikey", "api_key",
  ".aws\\credentials", "unattend.xml", "sysprep.xml", "web.config",
  "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", ".pem", ".pfx", ".p12",
  "vnc.ini", "filezilla", "winscp.ini", "putty", "bash_history", ".ssh"
]);
let CredentialHarvestingTools = dynamic([
  "lazagne", "nirsoft", "netpass", "credentialfileview", "passwordfox",
  "webbrowserpassview", "mailpassview", "vaultpassview", "credentialsfileview",
  "mimikatz", "wce.exe", "pwdump", "fgdump", "gsecdump"
]);
let CredentialRegistryPaths = dynamic([
  "\\SOFTWARE\\ORL\\WinVNC3\\Password",
  "\\SOFTWARE\\TightVNC\\Server",
  "\\SOFTWARE\\RealVNC\\WinVNC4",
  "\\SYSTEM\\CurrentControlSet\\Services\\SNMP\\Parameters\\ValidCommunities",
  "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
  "\\SOFTWARE\\SimonTatham\\PuTTY\\Sessions",
  "\\SOFTWARE\\OpenSSH",
  "DefaultPassword", "AltDefaultPassword"
]);
// Branch 1: Suspicious file access patterns indicating credential file enumeration
let FileCredentialAccess = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileAccessed", "FileRead")
| where FolderPath has_any (CredentialFilePatterns) or FileName has_any (CredentialFilePatterns)
| where InitiatingProcessFileName !in~ ("svchost.exe", "SearchIndexer.exe", "MsMpEng.exe", "OneDrive.exe")
| extend DetectionBranch = "CredentialFileAccess"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName, DetectionBranch;
// Branch 2: Known credential harvesting tools
let HarvestingTools = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (CredentialHarvestingTools)
   or ProcessCommandLine has_any (CredentialHarvestingTools)
   or InitiatingProcessFileName has_any (CredentialHarvestingTools)
| extend DetectionBranch = "CredentialHarvestingTool"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName, DetectionBranch;
// Branch 3: Registry queries to credential storage locations
let RegistryCredentialQuery = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any (CredentialRegistryPaths) or RegistryValueName has_any ("Password", "DefaultPassword", "AltDefaultPassword")
| where ActionType in ("RegistryKeyQueried", "RegistryValueQueried")
| where InitiatingProcessFileName !in~ ("svchost.exe", "lsass.exe", "services.exe")
| extend DetectionBranch = "RegistryCredentialQuery"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
         FileName=InitiatingProcessFileName, ProcessCommandLine=InitiatingProcessCommandLine,
         InitiatingProcessFileName=InitiatingProcessParentFileName,
         InitiatingProcessCommandLine=InitiatingProcessParentCommandLine,
         InitiatingProcessParentFileName="", DetectionBranch;
// Branch 4: PowerShell or cmd searching for credential content in files
let ScriptedCredentialSearch = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "bash", "sh")
| where ProcessCommandLine has_any (
    "Get-Content", "gc ", "cat ", "type ", "findstr", "grep",
    "Select-String", "sls "
  )
  and ProcessCommandLine has_any (
    "password", "passwd", "credentials", "secret", "apikey", "api_key",
    "connectionstring", "pwd", "passw"
  )
| extend DetectionBranch = "ScriptedCredentialSearch"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName, DetectionBranch;
union FileCredentialAccess, HarvestingTools, RegistryCredentialQuery, ScriptedCredentialSearch
| sort by Timestamp desc

Multi-branch detection for T1552 Unsecured Credentials across Windows endpoints using Microsoft Defender for Endpoint tables. Branch 1 detects file access to known credential storage locations (SSH keys, .aws/credentials, WinSCP configs, browser credential files). Branch 2 identifies execution of known credential harvesting tools (LaZagne, NirSoft suite, Mimikatz variants). Branch 3 monitors registry queries to locations where applications store credentials in plaintext (VNC, PuTTY, Winlogon). Branch 4 catches scripted searches using Get-Content, findstr, grep, or Select-String against files containing credential keywords. Uses DeviceFileEvents, DeviceProcessEvents, and DeviceRegistryEvents tables.

high severity medium confidence

Data Sources

File: File Access Process: Process Creation Windows Registry: Windows Registry Key Access Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceFileEvents DeviceProcessEvents DeviceRegistryEvents

False Positives

  • Password managers (KeePass, Bitwarden, 1Password desktop) legitimately accessing their own credential files
  • SSH clients (PuTTY, OpenSSH, WinSCP) reading .pem or known_hosts files as part of normal connection workflow
  • Configuration management tools (Ansible, Puppet, Chef) reading web.config or unattend.xml during deployments
  • Security scanners (Tenable, Qualys) that enumerate credential file locations as part of vulnerability assessments
  • Backup software reading all file types including credential-related files as part of scheduled backup jobs

Sigma rule & cross-platform mapping

The detection logic for Unsecured Credentials (T1552) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1552 Sigma rules on detection.fyi

Platform-specific guides for T1552

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (5)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1LaZagne All-Sources Credential Harvest Simulation

    Expected signal: Sysmon Event ID 1: Process Create for lazagne.exe with CommandLine 'all -oN'. Sysmon Event ID 11: Multiple file access events across browser profile directories, %APPDATA% credential stores, and credential files. Sysmon Event ID 13: Registry queries to PuTTY, VNC, and Winlogon password locations. File creation event for lazagne_test_output.txt.

  2. Test 2Scripted Credential File Search via PowerShell Select-String

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing both 'Select-String' and 'password'. PowerShell ScriptBlock Log Event ID 4104 capturing the full pipeline. Sysmon Event ID 11 for cred_search_results.txt creation. Multiple file access events as Select-String reads candidate files.

  3. Test 3Registry Credential Extraction — PuTTY and Winlogon

    Expected signal: Sysmon Event ID 1: Process Create for reg.exe with CommandLine querying PuTTY sessions path. If Sysmon is configured to monitor registry access, Event ID 13 showing TargetObject paths. Security Event ID 4663 (if object access auditing enabled) for registry key read operations.

  4. Test 4Private Key Enumeration and Staging

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine referencing '.pem', '.pfx', 'id_rsa'. Sysmon Event ID 11: File creation for key_staging directory. Multiple file access events as Get-ChildItem reads candidate key files. PowerShell ScriptBlock Log Event ID 4104 with full enumeration script.

  5. Test 5NirSoft WebBrowserPassView Credential Extraction

    Expected signal: Sysmon Event ID 1: Process Create for WebBrowserPassView.exe. Sysmon Event ID 11: File access to Chrome Login Data SQLite file at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data, Firefox logins.json, Edge Login Data. File creation event for browser_creds_test.html output. If DPAPI decryption is used, potential Event ID 4693 (DPAPI decryption) in Security log.

Response Playbook

Triage

  1. Identify which detection branch fired — tool-based detections (LaZagne, NirSoft) require immediate escalation; file access patterns require further context before escalation
  2. Examine the initiating process and its parent process chain — was a browser, Office application, or script interpreter spawning credential search activity? This strongly suggests post-exploitation
  3. Review the user account context — is this a service account, administrator, or standard user? Standard users accessing /etc/shadow or SYSTEM-level credential stores is a critical indicator
  4. Check the scope of credential file access — was a single file accessed (low risk) or did the process enumerate multiple credential locations across multiple directories in a short time window (high risk)?
  5. Query DeviceProcessEvents for the same host and user in the ±30 minutes around the alert timestamp — look for prior suspicious activity (phishing delivery, script execution, LOLBin use) that may indicate the credential search is a later stage of compromise
  6. For scripted searches (findstr/grep/Select-String), decode or reconstruct the full command to determine exact search terms — legitimate admins rarely search for 'password' or 'secret' across the filesystem without an explicit ticket
  7. Check for network activity from the same process after credential access — lateral movement or exfiltration attempts following credential harvesting are the key risk to contain
  8. For registry-based detections, identify which application the registry key belongs to and whether the accessing process is the expected owner or an unrelated process

Containment

  1. If known credential harvesting tool (LaZagne, Mimikatz, NirSoft) detected: immediately isolate the endpoint from the network via EDR network isolation or VLAN quarantine to prevent lateral movement with harvested credentials
  2. If credentials were likely accessed, assume all credentials stored on or accessible from that endpoint are compromised — initiate emergency rotation for service accounts, local admin accounts, and any credentials found in identified files
  3. If SSH private keys were accessed: revoke public keys from authorized_keys files on all remote systems accessible from the compromised endpoint and generate new key pairs
  4. If cloud credentials (AWS ~/.aws/credentials, Azure service principal files, GCP service account JSON) were accessed: immediately revoke and rotate the associated access keys and service principal secrets via the cloud provider console
  5. Block the user account in Active Directory and revoke active Kerberos tickets (run: klist purge on the endpoint; force replication of account lock) to prevent use of any cached domain credentials
  6. Preserve the endpoint for forensic analysis before reimaging — acquire memory dump and relevant log files

Evidence Collection

  1. File System: Enumerate all files accessed by the suspicious process using Sysmon Event ID 10 (Process Access) and Event ID 11 (File Create) correlated with the process PID
  2. File System: Check for exfiltration staging — look for compressed archives (.zip, .7z, .rar) created in Temp, AppData, or Downloads around the same time as credential access
  3. Registry: Export the registry hives accessed (HKCU\Software\SimonTatham\PuTTY\Sessions, HKLM\SOFTWARE\RealVNC, etc.) to document what credentials were stored there
  4. Process: Collect the full process tree via Sysmon Event ID 1 starting from the parent of the suspicious process — document PID, PPID, command lines, and hashes for all processes
  5. Network: Query Sysmon Event ID 3 (Network Connection) for outbound connections made by the suspicious process and any child processes — document destination IPs, ports, and connection counts
  6. Memory: Capture a full memory dump of the suspicious process if still running using ProcDump: procdump.exe -ma <PID> C:\evidence\<PID>.dmp
  7. Shell History: Preserve PowerShell ScriptBlock logs (Event IDs 4103/4104) from Microsoft-Windows-PowerShell/Operational channel and PSReadLine history file at $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
  8. Browser Credentials: Document which browser credential stores exist on the system (Chrome Login Data, Firefox logins.json, Edge Login Data) and whether they were accessed
  9. Prefetch: Capture and analyze prefetch files for the harvesting tool (C:\Windows\Prefetch\LAZAGNE.EXE-*.pf etc.) to establish execution timeline and loaded libraries

Escalation Criteria

  • ! Known credential harvesting tool (LaZagne, Mimikatz, NirSoft suite, fgdump, pwdump) detected executing on any endpoint regardless of whether it appears successful
  • ! Cloud credential files accessed (.aws/credentials, service account JSON, Azure CLI token cache) — cloud credentials enable lateral movement across the entire cloud environment, not just the local network
  • ! Private key files (.pem, .pfx, .p12, id_rsa) accessed by a process other than the owning application — compromised PKI material can enable impersonation and certificate fraud
  • ! Credential harvesting activity detected on a server or privileged workstation (domain controller, PAM station, build server, secrets management host)
  • ! Evidence of credential access followed within 30 minutes by new remote connection attempts (Sysmon Event ID 3, Security Event ID 4624 Type 3/10) — indicates active lateral movement using harvested credentials
  • ! Multiple credential storage locations enumerated sequentially by the same process — automated tooling pattern consistent with LaZagne's all-sources scan mode
  • ! Unattend.xml or Sysprep.inf accessed — these imaging configuration files frequently contain domain join and local administrator credentials in cleartext

Investigation Guide

Forensic Artifacts

  • > File System: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell command history including any commands containing credential keywords
  • > File System: ~/.bash_history, ~/.zsh_history, ~/.fish_history — Linux/macOS shell history files potentially containing credentials passed as arguments
  • > File System: ~/.aws/credentials and ~/.aws/config — AWS CLI stored access keys and session tokens
  • > File System: %APPDATA%\Microsoft\Credentials\ and %LOCALAPPDATA%\Microsoft\Credentials\ — DPAPI-protected Windows Credential Manager blobs
  • > File System: %APPDATA%\Microsoft\Protect\ — DPAPI master keys used to decrypt Windows credential blobs
  • > Registry: HKCU\Software\SimonTatham\PuTTY\Sessions — stored SSH session configurations potentially including passwords
  • > Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon — DefaultPassword value if auto-logon is configured
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities — SNMP community strings
  • > Browser Credential Stores: Chrome/Edge %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data (SQLite), Firefox %APPDATA%\Mozilla\Firefox\Profiles\*.default\logins.json
  • > Event Log: Microsoft-Windows-PowerShell/Operational Event ID 4104 — ScriptBlock logs capturing credential search scripts
  • > Windows Vault: cmdkey /list output, vaultcmd /listcreds:"Windows Credentials" — enumeration of Windows Credential Manager entries
  • > Prefetch: C:\Windows\Prefetch\LAZAGNE.EXE-*.pf, NETPASS.EXE-*.pf — execution evidence for credential harvesting tools

Tuning Guidance

Begin tuning by baselining which processes legitimately access credential-adjacent files and registry keys in your environment. Key exclusion candidates include: (1) SSH clients (ssh.exe, plink.exe, winscp.exe) accessing .pem and known_hosts files — add process + file type allowlist entries; (2) Password managers (KeePass, Bitwarden, 1Password) reading their own .kdbx or credential store files — exclude by process hash rather than process name to prevent tool masquerading; (3) Configuration management agents (SCCM, Ansible, Puppet) accessing web.config or unattend.xml during deployments — exclude by source IP or parent process. Elevate alert priority when multiple branches fire for the same host within 15 minutes, as this indicates a tool performing multi-source credential harvesting rather than incidental access. For scripted search detection, add environment-specific allowlist terms: if your infrastructure team legitimately runs scripts that search for 'connection_string' in config files, scope exclusions to specific service accounts and script paths rather than suppressing the entire pattern. Consider adding cloud credential file paths (.aws/credentials, gcp service account JSON locations, Azure CLI token cache) to the file access detection — these are high-value targets that warrant critical severity alerts regardless of context.

Hunting Queries

Hunt for accounts repeatedly using scripted filesystem searches targeting credential keyword patterns. Legitimate administrators rarely need to grep across the filesystem for passwords — multiple occurrences from the same user account or initiated from the same parent process (especially script interpreters) indicates automated credential harvesting.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)(findstr|select-string|grep|sls\s).{0,100}(passw|passwd|creds|secret|apikey|token|connectionstring)"
| summarize Count=count(), UniqueDevices=dcount(DeviceName), 
            Commands=make_set(ProcessCommandLine, 5),
            Earliest=min(Timestamp), Latest=max(Timestamp)
  by AccountName, InitiatingProcessFileName
| where Count > 2
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
(CommandLine="*findstr*" OR CommandLine="*Select-String*" OR CommandLine="*grep*")
(CommandLine="*passw*" OR CommandLine="*passwd*" OR CommandLine="*creds*" OR CommandLine="*secret*" OR CommandLine="*apikey*" OR CommandLine="*token*" OR CommandLine="*connectionstring*")
| stats count as SearchCount, dc(host) as UniqueHosts, values(CommandLine) as SampleCommands, earliest(_time) as Earliest, latest(_time) as Latest by User, ParentImage
| where SearchCount > 2
| sort - SearchCount

Hunt for bulk access to private key and credential store files within 15-minute windows, excluding known legitimate owners. Adversary credential harvesting tools typically access many credential file types in rapid succession — three or more distinct credential files accessed by an unexpected process within 15 minutes is a high-fidelity indicator of automated harvesting.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName endswith ".pem" or FileName endswith ".pfx" or FileName endswith ".p12"
   or FileName endswith "id_rsa" or FileName endswith "id_dsa" or FileName endswith "id_ecdsa" or FileName endswith "id_ed25519"
   or FileName =~ "credentials" or FileName endswith ".kdbx" or FileName =~ "logins.json"
| where ActionType in ("FileAccessed", "FileCopied", "FileRead")
| where InitiatingProcessFileName !in~ ("ssh.exe", "ssh-keygen.exe", "plink.exe", "scp.exe", "sftp.exe", "winscp.exe", "keepass.exe", "keepassxc.exe")
| summarize AccessCount=count(), AccessedFiles=make_set(FolderPath, 10), Processes=make_set(InitiatingProcessFileName, 5)
  by DeviceName, AccountName, bin(Timestamp, 15m)
| where AccessCount > 3
| sort by AccessCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.pem" OR TargetFilename="*.pfx" OR TargetFilename="*.p12" OR TargetFilename="*id_rsa" OR TargetFilename="*id_dsa" OR TargetFilename="*id_ecdsa" OR TargetFilename="*logins.json" OR TargetFilename="*.kdbx" OR TargetFilename="*credentials")
NOT (Image="*\\ssh.exe" OR Image="*\\ssh-keygen.exe" OR Image="*\\plink.exe" OR Image="*\\winscp.exe" OR Image="*\\keepass.exe")
| bin _time span=15m
| stats count as AccessCount, values(TargetFilename) as AccessedFiles, values(Image) as Processes by host, User, _time
| where AccessCount > 3
| sort - AccessCount

Hunt for processes querying multiple credential-related registry paths within a 30-minute window. Legitimate applications only access their own registry locations — a process querying VNC, PuTTY, SNMP, and Winlogon password locations in the same session is a strong indicator of automated registry credential harvesting, as performed by tools like LaZagne's registry module.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has_any (
    "PuTTY\\Sessions", "WinVNC3", "TightVNC", "RealVNC",
    "Winlogon", "SNMP\\Parameters", "OpenSSH"
  )
| where RegistryValueName has_any ("Password", "DefaultPassword", "ProxyPassword", "PublicKeyFile", "PrivateKeyFile")
| where ActionType in ("RegistryKeyQueried", "RegistryValueQueried")
| where InitiatingProcessFileName !in~ ("lsass.exe", "services.exe", "svchost.exe")
| summarize QueryCount=count(), RegistryKeys=make_set(RegistryKey, 10), 
            Processes=make_set(InitiatingProcessFileName, 5)
  by DeviceName, AccountName, bin(Timestamp, 30m)
| where QueryCount > 2 or array_length(RegistryKeys) > 2
| sort by QueryCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
(TargetObject="*PuTTY\\Sessions*" OR TargetObject="*WinVNC3*" OR TargetObject="*TightVNC*" OR TargetObject="*RealVNC*" OR TargetObject="*Winlogon*" OR TargetObject="*SNMP\\Parameters*")
(TargetObject="*Password*" OR TargetObject="*DefaultPassword*" OR TargetObject="*ProxyPassword*")
NOT (Image="*\\lsass.exe" OR Image="*\\svchost.exe" OR Image="*\\services.exe")
| bin _time span=30m
| stats count as QueryCount, values(TargetObject) as RegistryKeys, values(Image) as Processes by host, User, _time
| where QueryCount > 2
| sort - QueryCount

Atomic Red Team Tests

Test 1 LaZagne All-Sources Credential Harvest Simulation
windows

Simulates execution of LaZagne, an open-source credential recovery tool that searches 60+ application credential stores including browsers, email clients, databases, SVN, Git, WiFi, and Windows credential manager. Uses the 'all' module to trigger broad file and registry access patterns detectable by this rule. Download from GitHub Releases before running in your test environment only.

Command

powershell 
lazagne.exe all -oN -output C:\temp\lazagne_test_output.txt

Cleanup

powershell 
Remove-Item C:\temp\lazagne_test_output.txt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create for lazagne.exe with CommandLine 'all -oN'. Sysmon Event ID 11: Multiple file access events across browser profile directories, %APPDATA% credential stores, and credential files. Sysmon Event ID 13: Registry queries to PuTTY, VNC, and Winlogon password locations. File creation event for lazagne_test_output.txt.

Expected Detection

KQL Branch 2 (CredentialHarvestingTool) fires immediately on 'lazagne' in Image name. SPL branch 2 fires on Image containing 'lazagne'. Multiple Sysmon Event ID 11 events from branches 1/4 as tool accesses files. Risk score 75 (Critical severity).

Test 2 Scripted Credential File Search via PowerShell Select-String
windows

Uses PowerShell Select-String (equivalent to grep) to search for credential patterns across common Windows directories. Simulates adversary behavior of searching for plaintext passwords embedded in script files, configuration files, and deployment artifacts left on disk.

Command

powershell 
Get-ChildItem -Path C:\Users,$env:PROGRAMDATA,C:\inetpub -Recurse -Include *.txt,*.xml,*.config,*.ini,*.ps1,*.bat -ErrorAction SilentlyContinue | Select-String -Pattern "password|passwd|credentials|api_key|secret" -CaseSensitive:$false | Select-Object -First 20 | Out-File $env:TEMP\cred_search_results.txt

Cleanup

powershell 
Remove-Item $env:TEMP\cred_search_results.txt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing both 'Select-String' and 'password'. PowerShell ScriptBlock Log Event ID 4104 capturing the full pipeline. Sysmon Event ID 11 for cred_search_results.txt creation. Multiple file access events as Select-String reads candidate files.

Expected Detection

KQL Branch 4 (ScriptedCredentialSearch) fires on 'Select-String' + 'password' combination. SPL Branch 1 fires on EventCode=1 with matching CommandLine patterns. Alert classified as Medium severity (RiskScore 25) — correlate with file creation event to elevate.

Test 3 Registry Credential Extraction — PuTTY and Winlogon
windows

Queries Windows Registry locations where applications commonly store credentials insecurely. Targets PuTTY saved sessions (which may contain SSH passwords) and the Winlogon DefaultPassword key (used for auto-login configurations). Both are targeted by LaZagne's Windows registry module and manual attacker enumeration.

Command

powershell 
reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s 2>&1; reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword 2>&1; reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities" 2>&1

Expected Telemetry

Sysmon Event ID 1: Process Create for reg.exe with CommandLine querying PuTTY sessions path. If Sysmon is configured to monitor registry access, Event ID 13 showing TargetObject paths. Security Event ID 4663 (if object access auditing enabled) for registry key read operations.

Expected Detection

KQL Branch 3 (RegistryCredentialQuery) fires on RegistryKey containing 'PuTTY\Sessions' and 'Winlogon'. SPL Branch 3 fires on EventCode=13 with TargetObject patterns. Alert classified as High severity (RiskScore 50).

Test 4 Private Key Enumeration and Staging
windows

Searches for private key files across the filesystem and copies found keys to a staging directory — simulating the exfiltration preparation step that follows private key discovery. Private keys (.pem, .pfx, id_rsa) grant authentication to remote systems without passwords and are high-value targets in credential theft operations.

Command

powershell 
New-Item -ItemType Directory -Path $env:TEMP\key_staging -Force; Get-ChildItem -Path C:\Users -Recurse -Include *.pem,*.pfx,*.p12,id_rsa,id_dsa,id_ecdsa,id_ed25519 -ErrorAction SilentlyContinue | Select-Object -First 5 | ForEach-Object { Write-Host "Found: $($_.FullName)" }

Cleanup

powershell 
Remove-Item $env:TEMP\key_staging -Recurse -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine referencing '.pem', '.pfx', 'id_rsa'. Sysmon Event ID 11: File creation for key_staging directory. Multiple file access events as Get-ChildItem reads candidate key files. PowerShell ScriptBlock Log Event ID 4104 with full enumeration script.

Expected Detection

KQL Branch 1 (CredentialFileAccess) fires as .pem/.pfx/id_rsa patterns match FileName filter. SPL Branch 4 fires on Sysmon EventCode=11 matching private key file extensions. Additionally, KQL Branch 4 fires on the PowerShell commandline containing 'id_rsa' and file access patterns.

Test 5 NirSoft WebBrowserPassView Credential Extraction
windows

Simulates execution of WebBrowserPassView (NirSoft), a legitimate password recovery utility commonly abused by malware including Astaroth and DarkGate. This tool reads browser credential stores for Chrome, Edge, Firefox, IE, and Opera and presents them in cleartext. Run in isolated test environment only — tool requires download from NirSoft.

Command

powershell 
WebBrowserPassView.exe /shtml C:\temp\browser_creds_test.html

Cleanup

powershell 
Remove-Item C:\temp\browser_creds_test.html -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create for WebBrowserPassView.exe. Sysmon Event ID 11: File access to Chrome Login Data SQLite file at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data, Firefox logins.json, Edge Login Data. File creation event for browser_creds_test.html output. If DPAPI decryption is used, potential Event ID 4693 (DPAPI decryption) in Security log.

Expected Detection

KQL Branch 2 (CredentialHarvestingTool) fires immediately on 'webbrowserpassview' in FileName. SPL Branch 2 fires on Image containing 'webbrowserpassview'. Risk score 75 triggers Critical severity alert. File access to Chrome Login Data also triggers Branch 1 (CredentialFileAccess).

Related Detections

Tactic Hub

TA0006Credential Access

Sub-techniques (8)

Related Techniques

T1552.001Credentials In FilesT1552.002Credentials in RegistryT1552.003Bash HistoryT1552.004Private KeysT1552.005Cloud Instance Metadata APIT1552.006Group Policy PreferencesT1552.007Container APIT1555Credentials from Password StoresT1003OS Credential DumpingT1078Valid AccountsT1021Remote Services

Same Tactic: Credential Access

Popular Detections