T1552.001_credentials-in-files

T1552.001 Credentials In Files

Sub-technique of: T1552

High-Level Description

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.

In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files. They may also be found as parameters to deployment commands in container logs. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.

Kill Chain Phase

• Credential Access (TA0006)

Platforms: Containers, IaaS, Linux, macOS, Windows

What to Check

• Identify if Credentials In Files technique is applicable to target environment
• Check Containers systems for indicators of Credentials In Files
• Check IaaS systems for indicators of Credentials In Files
• Check Linux systems for indicators of Credentials In Files
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Find AWS credentials

Find local AWS credentials from file, defaults to using / as the look path.

Supported Platforms: macos, linux

find #{file_path}/.aws -name "credentials" -type f 2>/dev/null

Atomic Test 2: Extract Browser and System credentials with LaZagne

LaZagne Source

Supported Platforms: macos Elevation Required: Yes

python2 laZagne.py all

Atomic Test 3: Extract passwords with grep

Extracting credentials from files

Supported Platforms: linux, macos

grep -ri password #{file_path}
exit 0

Atomic Test 4: Extracting passwords with findstr

Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed.

Supported Platforms: windows

findstr /si pass *.xml *.doc *.txt *.xls
ls -R | select-string -ErrorAction SilentlyContinue -Pattern password

Atomic Test 5: Access unattend.xml

Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored. If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.

Supported Platforms: windows Elevation Required: Yes

type C:\Windows\Panther\unattend.xml
type C:\Windows\Panther\Unattend\unattend.xml

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Credentials In Files by examining the target platforms (Containers, IaaS, Linux).

2. Assess Existing Defenses: Review whether mitigations for T1552.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1017 User Training

Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.

M1047 Audit

Preemptively search for files containing passwords and take actions to reduce the exposure risk when found.

M1022 Restrict File and Directory Permissions

Restrict file shares to specific directories with access only to necessary users.

M1027 Password Policies

Establish an organizational policy that prohibits password storage in files.

Detection

Detect Access to Unsecured Credential Files Across Platforms

Risk Assessment

CWE Categories

References

• CG 2014
• Unit 42 Hildegard Malware
• Unit 42 Unsecured Docker Daemons
• Specter Ops - Cloud Credential Storage
• SRD GPP
• Atomic Red Team - T1552.001
• MITRE ATT&CK - T1552.001