attack.t1552.001 | Detection.FYI

Credentials In Files - Linux

Dec 8, 2025 · attack.credential-access attack.t1552.001 ·
Share on:

Detecting attempts to extract passwords with grep

Read More
PUA - TruffleHog Execution

Oct 21, 2025 · attack.discovery attack.credential-access attack.t1083 attack.t1552.001 ·
Share on:

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

Read More
PUA - TruffleHog Execution - Linux

Oct 21, 2025 · attack.discovery attack.credential-access attack.t1083 attack.t1552.001 ·
Share on:

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

Read More
Potentially Suspicious JWT Token Search Via CLI

Oct 21, 2025 · attack.credential-access attack.t1528 attack.t1552.001 ·
Share on:

Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.

Read More
Shai-Hulud Malicious GitHub Workflow Creation

Oct 19, 2025 · attack.persistence attack.credential-access attack.t1552.001 attack.collection attack.t1119 detection.emerging-threats ·
Share on:

Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

Read More
Potential PowerShell Console History Access Attempt via History File

Sep 22, 2025 · attack.credential-access attack.t1552.001 ·
Share on:

Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt). This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.

Read More
Insensitive Subfolder Search Via Findstr.EXE

Aug 28, 2025 · attack.defense-evasion attack.credential-access attack.command-and-control attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Read More
Remote File Download Via Findstr.EXE

Aug 28, 2025 · attack.defense-evasion attack.credential-access attack.command-and-control attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Read More
Hidden Flag Set On File/Directory Via Chflags - MacOS

Jul 1, 2025 · attack.defense-evasion attack.credential-access attack.command-and-control attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Read More
HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
Automated Collection Command Prompt

Aug 12, 2024 · attack.collection attack.t1119 attack.credential-access attack.t1552.001 ·
Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Read More
Azure Key Vault Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·
Share on:

Identifies when a key vault is modified or deleted.

Read More
Azure Keyvault Key Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·
Share on:

Identifies when a Keyvault Key is modified or deleted in Azure.

Read More
Azure Keyvault Secrets Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·
Share on:

Identifies when secrets are modified or deleted in Azure.

Read More
Cisco Collect Data

Aug 12, 2024 · attack.discovery attack.credential-access attack.collection attack.t1087.001 attack.t1552.001 attack.t1005 ·
Share on:

Collect pertinent data from the configuration files

Read More
Copy Passwd Or Shadow From TMP Path

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·
Share on:

Detects when the file "passwd" or "shadow" is copied from tmp path

Read More
Credentials In Files

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·
Share on:

Detecting attempts to extract passwords with grep and laZagne

Read More
Extracting Information with PowerShell

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·
Share on:

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Read More
HackTool - Typical HiveNightmare SAM File Export

Aug 12, 2024 · attack.credential-access attack.t1552.001 cve.2021-36934 ·
Share on:

Detects files written by the different tools that exploit HiveNightmare

Read More
Linux Recon Indicators

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 attack.credential-access attack.t1552.001 ·
Share on:

Detects events with patterns found in commands used for reconnaissance on linux systems

Read More
Potential Russian APT Credential Theft Activity

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 detection.emerging-threats ·
Share on:

Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

Read More
Extract Credentials From IIS Application Pool Configuration Files

Aug 10, 2024 · attack.CredentialAccess attack.T1552.001 ·
Share on:

Detects the execution of appcmd.exe that is used to extract credentials from configuration files. IIS application pools can run as different users for security and isolation purposes. When a user is specified for the application pool, their credentials are stored in plaintext in the configuration file.

Read More