Detect Credentials In Files in Elastic Security
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These include user-created credential files, shared credential stores, configuration files with embedded passwords, and source code containing hardcoded credentials. Threat actors and malware including Emotet, APT33, LaZagne, Pupy, PoshC2, and Smoke Loader actively search for credential files. Commonly targeted files include web.config, applicationHost.config, .htaccess, unattend.xml (Group Policy Preferences), cloud credential files (~/.aws/credentials, ~/.azure/accessTokens.json), and any plaintext files with 'password' in the content.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.001 Credentials In Files
- Canonical reference
- https://attack.mitre.org/techniques/T1552/001/
Elastic Detection Query
sequence by host.id with maxspan=5m
[process where event.type == "start" and (
(process.name in ("findstr.exe", "grep", "grep.exe") and
process.args : ("*password*", "*passwd*", "*cred*", "*unattend*", "*web.config*", "*.pem*", "*.pfx*", "*.ppk*")) or
(process.name in ("powershell.exe", "pwsh.exe") and
process.args : ("*Select-String*", "*Get-ChildItem*", "*Get-Content*") and
process.args : ("*password*", "*credentials*", "*.pem*", "*.pfx*", "*.ppk*", "*id_rsa*")) or
(process.name == "cmd.exe" and
process.args : ("*dir*") and
process.args : ("*password*", "*cred*", "*credentials*")) or
(process.name : ("lazagne.exe", "mimikatz.exe")) or
(process.args : ("*lazagne*", "*mimikatz*"))
)] by process.entity_id
[file where event.action in ("open", "read", "accessed") and
(
file.path : ("*\\.ssh\\*", "*\\.aws\\credentials*", "*\\.azure\\*",
"*ConsoleHost_history.txt*", "*Unattend.xml*", "*sysprep.xml*",
"*web.config*", "*applicationHost.config*", "*\\.htpasswd*",
"*\\id_rsa*", "*\\id_ecdsa*", "*\\id_ed25519*",
"*accessTokens.json*", "*credentials.json*",
"*passwords.txt*", "*creds.txt*", "*logins.json*") or
file.extension in ("pem", "ppk", "p12", "pfx", "key")
) and
not process.name in~ ("explorer.exe", "OneDrive.exe", "backup.exe", "svchost.exe")
] by process.entity_id
OR
any where event.category == "file" and
event.action in ("open", "read", "accessed") and
(
file.path : ("*\\.ssh\\*", "*\\.aws\\credentials*", "*\\.azure\\accessTokens.json*",
"*ConsoleHost_history.txt*", "*Unattend.xml*", "*sysprep.xml*",
"*web.config*", "*applicationHost.config*",
"*\\id_rsa", "*\\id_ecdsa", "*\\id_ed25519",
"*passwords.txt", "*creds.txt", "*logins.json",
"*accessTokens.json", "*credentials.json",
"*KeePass*", "*1Password*") or
file.extension in ("pem", "ppk", "p12", "pfx")
) and
not process.name in~ ("explorer.exe", "OneDrive.exe", "backup.exe", "svchost.exe", "taskhostw.exe")Detects adversary searches for locally stored credentials via common credential-hunting tools (findstr, grep, LaZagne, PowerShell cmdlets) and direct file access to known credential file locations including SSH keys, cloud provider credential files, browser credential stores, Windows history files, and plaintext password files. Covers threat actors such as Emotet, APT33, and tools like LaZagne and PoshC2.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT administrators auditing credential files for compliance or rotation purposes using the same tooling
- Backup solutions and configuration management tools (Ansible, Puppet, Chef) that legitimately read configuration files containing credentials during deployment or backup operations
- Developer workflows that read .aws/credentials, SSH keys, or application config files as part of normal development or CI/CD pipeline operations
- Security scanning tools (Tenable, Qualys, Nessus agents) that may enumerate config files during vulnerability assessments
Other platforms for T1552.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Search for Passwords in Files with findstr
Expected signal: Sysmon Event ID 1: findstr.exe with 'password' and recursive flags. Security Event ID 4688 (if command-line auditing). Security Event ID 4663 (Object Access) for any files accessed if Object Access auditing enabled.
- Test 2Read AWS Credentials File
Expected signal: Sysmon Event ID 1: cmd.exe with 'type' and '.aws\credentials'. Sysmon Event ID 11: file access for credentials file. Security Event ID 4663 if Object Access auditing enabled for the file.
- Test 3LaZagne Credential Harvesting
Expected signal: Sysmon Event ID 1: lazagne.exe with 'all' flag. Multiple file access events across credential locations (browser profiles, email clients, SSH directories). File creation event for output file.
- Test 4Search for GPP Credentials in SYSVOL
Expected signal: Sysmon Event ID 1: cmd.exe with dir and findstr against SYSVOL. Sysmon Event ID 3: network connection to domain controller on SMB (port 445). Security Event ID 5140 (share access to \\*\SYSVOL) on the domain controller.
References (7)
- https://attack.mitre.org/techniques/T1552/001/
- https://github.com/AlessandroZ/LaZagne
- https://obscuresecurity.blogspot.com/2012/05/gpp-passwords-in-group-policy.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.001/T1552.001.md
- https://specterops.io/blog/cloud-credential-storage/
- https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html
- https://docs.microsoft.com/en-us/azure/active-directory/develop/authentication-scenarios
Unlock Pro Content
Get the full detection package for T1552.001 including response playbook, investigation guide, and atomic red team tests.