Detect Credentials In Files in Microsoft Sentinel
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These include user-created credential files, shared credential stores, configuration files with embedded passwords, and source code containing hardcoded credentials. Threat actors and malware including Emotet, APT33, LaZagne, Pupy, PoshC2, and Smoke Loader actively search for credential files. Commonly targeted files include web.config, applicationHost.config, .htaccess, unattend.xml (Group Policy Preferences), cloud credential files (~/.aws/credentials, ~/.azure/accessTokens.json), and any plaintext files with 'password' in the content.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.001 Credentials In Files
- Canonical reference
- https://attack.mitre.org/techniques/T1552/001/
KQL Detection Query
// Detect credential file search and access
let CredentialFilePaths = dynamic([
".aws/credentials", ".azure", "accessTokens.json", "credentials.json",
"unattend.xml", "sysprep.xml", "web.config", "applicationHost.config",
"passwd", "shadow", ".htpasswd", "id_rsa", "id_ecdsa", "id_ed25519",
"ConsoleHost_history.txt", ".bash_history", ".zsh_history",
"KeePass", "1Password", "passwords.txt", "creds.txt", "logins.json"
]);
let SearchToolPatterns = dynamic([
"findstr", "Select-String", "grep", "dir /s", "Get-ChildItem",
"type ", "cat ", "LaZagne", "mimikatz"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
// Credential file access via search tools
| where ProcessCommandLine has_any (CredentialFilePaths)
and ProcessCommandLine has_any (SearchToolPatterns)
| extend SearchTool = case(
ProcessCommandLine has "findstr", "findstr",
ProcessCommandLine has "Select-String", "Select-String",
ProcessCommandLine has "Get-ChildItem", "Get-ChildItem",
ProcessCommandLine has "LaZagne", "LaZagne",
"Other"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, SearchTool
| union (
// Detect direct file access to known credential file locations
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileRead" or ActionType == "FileAccessed"
| where FolderPath has_any (".ssh", ".aws", ".azure", "PSReadline",
"Unattend", "SYSVOL", "sysprep")
and (FileName has_any ("credentials", "password", "id_rsa", "history",
"unattend", "sysprep", "accessTokens") or
FileName endswith ".pem" or FileName endswith ".ppk" or
FileName endswith ".p12" or FileName endswith ".pfx")
| where InitiatingProcessFileName !in~ ("explorer.exe", "OneDrive.exe", "backup.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FolderPath, FileName,
InitiatingProcessFileName, InitiatingProcessCommandLine
)
| sort by Timestamp descDetects credential file searching and access via two patterns: process command lines combining search tools (findstr, Select-String, Get-ChildItem, grep) with credential file paths or names; and direct file read/access events on known credential file locations (.ssh, .aws, .azure, PSReadline history, Unattend files). Uses DeviceProcessEvents and DeviceFileEvents from Microsoft Defender for Endpoint.
Data Sources
Required Tables
False Positives & Tuning
- Backup agents legitimately reading configuration files and credential stores as part of system backup operations
- Security scanning tools (Tenable, Qualys) that enumerate credential files during vulnerability assessments
- Configuration management tools (Ansible, Chef, Puppet) reading configuration files including those containing credentials
- Password managers and single sign-on agents that legitimately access credential file locations
- IT auditing scripts that scan for hardcoded credentials as a security best practice enforcement measure
Other platforms for T1552.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Search for Passwords in Files with findstr
Expected signal: Sysmon Event ID 1: findstr.exe with 'password' and recursive flags. Security Event ID 4688 (if command-line auditing). Security Event ID 4663 (Object Access) for any files accessed if Object Access auditing enabled.
- Test 2Read AWS Credentials File
Expected signal: Sysmon Event ID 1: cmd.exe with 'type' and '.aws\credentials'. Sysmon Event ID 11: file access for credentials file. Security Event ID 4663 if Object Access auditing enabled for the file.
- Test 3LaZagne Credential Harvesting
Expected signal: Sysmon Event ID 1: lazagne.exe with 'all' flag. Multiple file access events across credential locations (browser profiles, email clients, SSH directories). File creation event for output file.
- Test 4Search for GPP Credentials in SYSVOL
Expected signal: Sysmon Event ID 1: cmd.exe with dir and findstr against SYSVOL. Sysmon Event ID 3: network connection to domain controller on SMB (port 445). Security Event ID 5140 (share access to \\*\SYSVOL) on the domain controller.
References (7)
- https://attack.mitre.org/techniques/T1552/001/
- https://github.com/AlessandroZ/LaZagne
- https://obscuresecurity.blogspot.com/2012/05/gpp-passwords-in-group-policy.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.001/T1552.001.md
- https://specterops.io/blog/cloud-credential-storage/
- https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html
- https://docs.microsoft.com/en-us/azure/active-directory/develop/authentication-scenarios
Unlock Pro Content
Get the full detection package for T1552.001 including response playbook, investigation guide, and atomic red team tests.