Detect Credentials In Files in Sumo Logic CSE
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These include user-created credential files, shared credential stores, configuration files with embedded passwords, and source code containing hardcoded credentials. Threat actors and malware including Emotet, APT33, LaZagne, Pupy, PoshC2, and Smoke Loader actively search for credential files. Commonly targeted files include web.config, applicationHost.config, .htaccess, unattend.xml (Group Policy Preferences), cloud credential files (~/.aws/credentials, ~/.azure/accessTokens.json), and any plaintext files with 'password' in the content.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.001 Credentials In Files
- Canonical reference
- https://attack.mitre.org/techniques/T1552/001/
Sumo Detection Query
// Credential File Search and Access Detection - T1552.001
(_sourceCategory="*WinEventLog*" OR _sourceCategory="*Sysmon*" OR _sourceCategory="*endpoint*")
| parse "Image=*\\\\*" as process_path, process_name nodrop
| parse "CommandLine=*" as command_line nodrop
| parse "TargetFilename=*" as target_file nodrop
| parse "User=*" as user nodrop
| parse "Computer=*" as host nodrop
| parse "EventCode=*" as event_code nodrop
| where (
// Credential file search via process activity (Sysmon EID 1 / Security EID 4688)
(
event_code in ("1", "4688")
and (
(
process_name matches "(?i)(findstr\\.exe|grep\\.exe|grep)"
and (
command_line matches "(?i)(password|passwd|credential|unattend|sysprep|web\\.config|\\.pem|\\.pfx|\\.ppk|id_rsa)"
)
)
or (
process_name matches "(?i)(powershell\\.exe|pwsh\\.exe)"
and command_line matches "(?i)(Select-String|Get-ChildItem|Get-Content)"
and command_line matches "(?i)(password|credentials|id_rsa|\\.pem|\\.pfx|\\.ppk|accessTokens|logins\\.json)"
)
or (
process_name matches "(?i)(cmd\\.exe)"
and command_line matches "(?i)dir "
and command_line matches "(?i)(password|credentials|cred)"
)
or command_line matches "(?i)(lazagne|mimikatz)"
or process_name matches "(?i)(lazagne\\.exe|mimikatz\\.exe)"
)
)
or
// Direct credential file access (Sysmon EID 11)
(
event_code == "11"
and (
target_file matches "(?i)(\\.ssh[\\/]|credentials|\\.aws[\\/]credentials|\\.azure[\\/]|ConsoleHost_history\.txt|Unattend\.xml|sysprep\.xml|web\.config|applicationHost\.config|id_rsa|id_ecdsa|id_ed25519|accessTokens\.json|credentials\.json|passwords\.txt|creds\.txt|logins\.json|KeePass|1Password|\.ppk|\.pfx|\.p12|\.pem)"
)
and not process_name matches "(?i)(explorer\.exe|OneDrive\.exe|backup\.exe|svchost\.exe)"
)
)
| eval alert_type = if(event_code in ("1","4688"), "CredentialFileSearch", "CredentialFileAccess")
| count by _messageTime, host, user, process_name, command_line, target_file, alert_type
| sort by _messageTime descDetects adversaries searching for credentials stored in files on Windows and Linux systems. Monitors for credential-hunting tool usage (findstr, grep, PowerShell Select-String/Get-ChildItem, LaZagne, Mimikatz) targeting known credential file paths and direct file access to SSH keys, cloud provider credential files, browser credential stores, Windows shell history files, and web configuration files containing embedded passwords.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators and security teams performing credential audits or using tools like findstr and PowerShell to validate credential file locations for compliance and rotation activities
- Application deployments and CI/CD pipelines that access .aws/credentials, SSH keys, or service account credential files as part of legitimate build and deployment workflows
- Password manager applications (KeePass, 1Password) opening their own credential database files during normal user operation
Other platforms for T1552.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Search for Passwords in Files with findstr
Expected signal: Sysmon Event ID 1: findstr.exe with 'password' and recursive flags. Security Event ID 4688 (if command-line auditing). Security Event ID 4663 (Object Access) for any files accessed if Object Access auditing enabled.
- Test 2Read AWS Credentials File
Expected signal: Sysmon Event ID 1: cmd.exe with 'type' and '.aws\credentials'. Sysmon Event ID 11: file access for credentials file. Security Event ID 4663 if Object Access auditing enabled for the file.
- Test 3LaZagne Credential Harvesting
Expected signal: Sysmon Event ID 1: lazagne.exe with 'all' flag. Multiple file access events across credential locations (browser profiles, email clients, SSH directories). File creation event for output file.
- Test 4Search for GPP Credentials in SYSVOL
Expected signal: Sysmon Event ID 1: cmd.exe with dir and findstr against SYSVOL. Sysmon Event ID 3: network connection to domain controller on SMB (port 445). Security Event ID 5140 (share access to \\*\SYSVOL) on the domain controller.
References (7)
- https://attack.mitre.org/techniques/T1552/001/
- https://github.com/AlessandroZ/LaZagne
- https://obscuresecurity.blogspot.com/2012/05/gpp-passwords-in-group-policy.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.001/T1552.001.md
- https://specterops.io/blog/cloud-credential-storage/
- https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html
- https://docs.microsoft.com/en-us/azure/active-directory/develop/authentication-scenarios
Unlock Pro Content
Get the full detection package for T1552.001 including response playbook, investigation guide, and atomic red team tests.