attack.t1552

Application AppID Uri Configuration Changes

Apr 28, 2026 · attack.initial-access attack.persistence attack.credential-access attack.privilege-escalation attack.stealth attack.t1552 attack.t1078.004 ·

Share on:

Detects when a configuration change is made to an applications AppID URI.

Azure Kubernetes Admission Controller

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·

Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Google Cloud Kubernetes Admission Controller

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·

Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Kubernetes Admission Controller Modification

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·

Share on:

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Potential Okta Password in AlternateID Field

Apr 27, 2026 · attack.credential-access attack.t1552 ·

Share on:

Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

Script Interpreter Spawning Credential Scanner - Linux

Mar 29, 2026 · attack.credential-access attack.t1552 attack.execution attack.collection attack.t1005 attack.t1059.004 ·

Share on:

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

Script Interpreter Spawning Credential Scanner - Windows

Mar 29, 2026 · attack.credential-access attack.t1552 attack.collection attack.execution attack.t1005 attack.t1059.007 ·

Share on:

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

Potentially Suspicious EventLog Recon Activity Using Log Query Utilities

Dec 9, 2025 · attack.credential-access attack.discovery attack.t1552 attack.t1087 ·

Share on:

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Added Owner To Application

Aug 12, 2024 · attack.t1552 attack.credential-access ·

Share on:

Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

Azure Key Vault Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·

Share on:

Identifies when a key vault is modified or deleted.

Azure Keyvault Key Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·

Share on:

Identifies when a Keyvault Key is modified or deleted in Azure.

Azure Keyvault Secrets Modified or Deleted

Aug 12, 2024 · attack.impact attack.credential-access attack.t1552 attack.t1552.001 ·

Share on:

Identifies when secrets are modified or deleted in Azure.