Detect Credentials In Files in Splunk
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These include user-created credential files, shared credential stores, configuration files with embedded passwords, and source code containing hardcoded credentials. Threat actors and malware including Emotet, APT33, LaZagne, Pupy, PoshC2, and Smoke Loader actively search for credential files. Commonly targeted files include web.config, applicationHost.config, .htaccess, unattend.xml (Group Policy Preferences), cloud credential files (~/.aws/credentials, ~/.azure/accessTokens.json), and any plaintext files with 'password' in the content.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.001 Credentials In Files
- Canonical reference
- https://attack.mitre.org/techniques/T1552/001/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
(
EventCode=1
(
(Image="*\\findstr.exe" AND (CommandLine="*password*" OR CommandLine="*passwd*" OR CommandLine="*cred*" OR CommandLine="*unattend*" OR CommandLine="*sysprep*" OR CommandLine="*web.config*"))
OR
(Image="*\\powershell.exe" AND (CommandLine="*Select-String*" OR CommandLine="*Get-ChildItem*") AND (CommandLine="*password*" OR CommandLine="*.pem*" OR CommandLine="*.pfx*" OR CommandLine="*.ppk*" OR CommandLine="*credentials*"))
OR
(Image="*\\lazagne.exe" OR CommandLine="*lazagne*")
OR
(Image="*\\cmd.exe" AND CommandLine="*dir*" AND (CommandLine="*password*" OR CommandLine="*credentials*"))
)
| eval AlertType="CredFileSearch"
)
OR
(
EventCode=11
(
TargetFilename="*\\.ssh\\*" OR TargetFilename="*\\.aws\\credentials*" OR TargetFilename="*ConsoleHost_history.txt*"
OR TargetFilename="*Unattend.xml*" OR TargetFilename="*sysprep.xml*" OR TargetFilename="*web.config*"
OR TargetFilename="*\\id_rsa" OR TargetFilename="*.ppk" OR TargetFilename="*.pfx" OR TargetFilename="*.pem"
)
NOT (Image IN ("*\\backup.exe", "*\\OneDrive.exe", "*\\explorer.exe"))
| eval AlertType="CredFileAccess"
)
| table _time, host, User, Image, CommandLine, TargetFilename, AlertType
| sort - _timeDetects credential file searching using Sysmon Event ID 1: findstr.exe with password-related terms, PowerShell Select-String/Get-ChildItem for credential files, LaZagne execution, and cmd dir commands searching for credentials. Also detects direct file access (Sysmon Event ID 11) to known credential locations including .ssh keys, AWS credentials, PowerShell history, and Unattend/Sysprep XML files.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Backup agents reading configuration and credential files
- Security scanning tools enumerating credential files
- Configuration management tools reading configuration files
- Password managers accessing credential locations
- IT auditing scripts scanning for hardcoded credentials
Other platforms for T1552.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Search for Passwords in Files with findstr
Expected signal: Sysmon Event ID 1: findstr.exe with 'password' and recursive flags. Security Event ID 4688 (if command-line auditing). Security Event ID 4663 (Object Access) for any files accessed if Object Access auditing enabled.
- Test 2Read AWS Credentials File
Expected signal: Sysmon Event ID 1: cmd.exe with 'type' and '.aws\credentials'. Sysmon Event ID 11: file access for credentials file. Security Event ID 4663 if Object Access auditing enabled for the file.
- Test 3LaZagne Credential Harvesting
Expected signal: Sysmon Event ID 1: lazagne.exe with 'all' flag. Multiple file access events across credential locations (browser profiles, email clients, SSH directories). File creation event for output file.
- Test 4Search for GPP Credentials in SYSVOL
Expected signal: Sysmon Event ID 1: cmd.exe with dir and findstr against SYSVOL. Sysmon Event ID 3: network connection to domain controller on SMB (port 445). Security Event ID 5140 (share access to \\*\SYSVOL) on the domain controller.
References (7)
- https://attack.mitre.org/techniques/T1552/001/
- https://github.com/AlessandroZ/LaZagne
- https://obscuresecurity.blogspot.com/2012/05/gpp-passwords-in-group-policy.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.001/T1552.001.md
- https://specterops.io/blog/cloud-credential-storage/
- https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html
- https://docs.microsoft.com/en-us/azure/active-directory/develop/authentication-scenarios
Unlock Pro Content
Get the full detection package for T1552.001 including response playbook, investigation guide, and atomic red team tests.