SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Identity, authentication and credential attacks

Unsecured credentials

Plaintext secrets in config files, scripts, registry, history or Group Policy Preferences

categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Highlabdetected in lab

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1552.001 · Access Drone CI Config File · Atomic Red Team
sudo /opt/lab/detonate.sh --technique T1552.001 --tool atomic --run-id <run-id> -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1552.001 -TestGuids a11f22fb-a037-4cc2-bcfc-a133b287aa1b -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'
ATT&CK T1552.001 · Atomic Red Team
sudo /opt/lab/detonate.sh --technique T1552.001 --tool atomic --run-id run-2026-10-20-003 -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1552.001 -TestGuids a11f22fb-a037-4cc2-bcfc-a133b287aa1b -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'
ATT&CK T1552.001 · Atomic Red Team
sudo /opt/lab/detonate.sh --technique T1552.001 --tool atomic --run-id run-2026-10-27-029 -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1552.001 -TestGuids a11f22fb-a037-4cc2-bcfc-a133b287aa1b -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'

+ 14 more test variant(s) in the corpus.

What our lab measured

detected linux · 2026-10-28 · detected in 1s

Detection that fired

  • ✓ Wazuh 100430 (level 6) lab rule — Credential-bearing file read via a shell reader (cat/grep/tail/... of a secrets/config file) -- unsecured credentials in files -- T1552.001
  • ✓ Wazuh 100431 (level 5) lab rule — Filesystem search tool (grep/find) executed -- possible unsecured-credential discovery -- T1552.003

Plus 1 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~300 incidental alerts/hour — tune against this.

detected linux · 2026-10-28 · detected in 3s

Detection that fired

  • ✓ Wazuh 100431 (level 5) lab rule — Filesystem search tool (grep/find) executed -- possible unsecured-credential discovery -- T1552.003

Plus 3 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~194 incidental alerts/hour — tune against this.

Classification

41 values: 8 reviewed, 3 lab-measured, 24 imported, 6 derived. What do these mean?

Exploitability

Attack vectorCredential attacks
Reach (CVSS)Local
Attack complexityLow
Privileges requiredLow
User interactionNone
Attacker skill requiredHigh
Resources requiredLow
Likelihood / prevalenceMedium
MaturityCommoditized

Impact & scope

SeverityHigh
ImpactConfidentiality
PlatformContainersIaaSLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
EnvironmentCloudOn-premises
Target asset classIdentity
Kill-chain phase (tactic)Credential Access

Detection & telemetry

Detectability (measured in our lab)High
Detectability (public detection content)High
Noise levelHigh
TestabilityAtomic Red Team test
Data sources (ATT&CK data components)Application Log ContentCloud Service MetadataCommand ExecutionFile AccessFile CreationLogon Session CreationNetwork Connection CreationNetwork Share AccessNetwork Traffic ContentProcess CreationProcess MetadataScript ExecutionWindows Registry Key AccessWindows Registry Key Modification

Detection & response

Mitigated by 41

  • M1015 attack-mitigation
  • M1017 attack-mitigation
  • M1018 attack-mitigation
  • M1022 attack-mitigation
  • M1026 attack-mitigation
  • M1027 attack-mitigation
  • M1028 attack-mitigation
  • M1030 attack-mitigation
  • M1035 attack-mitigation
  • M1037 attack-mitigation
  • M1041 attack-mitigation
  • M1042 attack-mitigation
  • M1047 attack-mitigation
  • M1051 attack-mitigation
  • D3-AM d3fend
  • D3-ANCI d3fend
  • D3-CCSA d3fend
  • D3-CF d3fend
  • D3-CH d3fend
  • D3-CI d3fend
  • D3-CM d3fend
  • D3-CQ d3fend
  • D3-CR d3fend
  • D3-CRO d3fend
  • D3-CTS d3fend
  • D3-DF d3fend
  • D3-DI d3fend
  • D3-DUC d3fend
  • D3-FA d3fend
  • D3-FE d3fend
  • D3-FEV d3fend
  • D3-FIM d3fend
  • D3-LFP d3fend
  • D3-MFA d3fend
  • D3-NTPM d3fend
  • D3-RC d3fend
  • D3-RD d3fend
  • D3-RF d3fend
  • D3-RFAM d3fend
  • D3-RIC d3fend
  • … and 1 more in the database

Detected by 60

  • DET0001 attack-detection-strategy
  • DET0111 attack-detection-strategy
  • DET0198 attack-detection-strategy
  • DET0250 attack-detection-strategy
  • DET0307 attack-detection-strategy
  • DET0381 attack-detection-strategy
  • DET0385 attack-detection-strategy
  • DET0549 attack-detection-strategy
  • 04936b66-3915-43ad-a8e5-809eadfd1141 sigma
  • 05f3c945-dcc8-4393-9f3d-af65077a8f86 sigma
  • 0aba5685-6db6-486f-88ef-29a99c545cfd sigma
  • 0cf7a157-8879-41a2-8f55-388dd23746b7 sigma
  • 1a0f6f16-2099-4753-9a02-43b6ac7a1fa5 sigma
  • 1f978c6a-4415-47fb-aca5-736a44d7ca3d sigma
  • 213d6a77-3d55-4ce8-ba74-fcfef741974e sigma
  • 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe sigma
  • 44030449-b0df-4c94-aae1-502359ab28ee sigma
  • 459a2970-bb84-4e6a-a32e-ff0fbd99448d sigma
  • 47e4bab7-c626-47dc-967b-255608c9a920 sigma
  • 508a9374-ad52-4789-b568-fc358def2c65 sigma
  • 53b1b378-9b06-4992-b972-dde6e423d2b4 sigma
  • 587254ee-a24b-4335-b3cd-065c0f1f4baa sigma
  • 68fcba0d-73a5-475e-a915-e8b4c576827e sigma
  • 6ad91e31-53df-4826-bd27-0166171c8040 sigma
  • 6d3a3952-6530-44a3-8554-cf17c116c615 sigma
  • 6ea858a8-ba71-4a12-b2cc-5d83312404c7 sigma
  • 76a26006-0942-430b-8249-bd51d448f8e5 sigma
  • 7892ec59-c5bb-496d-8968-e5d210ca3ac4 sigma
  • 80eeab92-0979-4152-942d-96749e11df40 sigma
  • 8344c19f-a023-45ff-ad63-a01c5396aea0 sigma
  • 851fd622-b675-4d26-b803-14bc7baa517a sigma
  • 87a476dc-0079-4583-a985-dee7a20a03de sigma
  • 91a2c315-9ee6-4052-a853-6f6a8238f90d sigma
  • 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb sigma
  • a61a3c56-4ce2-4351-a079-88ae4cbd2b58 sigma
  • aa7a3fce-bef5-4311-9cc1-5f04bb8c308c sigma
  • b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b sigma
  • b2815d0d-7481-4bf0-9b6c-a4c48a94b349 sigma
  • b831353c-1971-477b-abb6-2828edc3bca1 sigma
  • b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee sigma
  • … and 20 more in the database

Tested by 63

  • 00e3e3c7-6c3c-455e-bd4b-461c7f0e7797 atomic
  • 0d4f2281-f720-4572-adc8-d5bb1618affe atomic
  • 0e56bf29-ff49-4ea5-9af4-3b81283fd513 atomic
  • 114dd4e3-8d1c-4ea7-bb8d-8d8f6aca21f0 atomic
  • 12e4a260-a7fd-4ed8-bf18-1a28c1395775 atomic
  • 14575d1f-16b3-4a0b-8986-540e42e6a6cc atomic
  • 18318786-e0c0-4bdf-979f-f022e6f5f2ef atomic
  • 290df60e-4b5d-4a5e-b0c7-dc5348ea0c86 atomic
  • 2951c09f-b4f9-4248-ba75-6373709ebd55 atomic
  • 2a24627b-061b-43e6-bece-a5b0638841dd atomic
  • 2a5a0601-f5fb-4e2e-aa09-73282ae6afca atomic
  • 31e794c4-48fd-4a76-aca4-6587c155bc11 atomic
  • 336b25bf-4514-4684-8924-474974f28137 atomic
  • 367d4004-5fc0-446d-823f-960c74ae52c3 atomic
  • 37807632-d3da-442e-8c2e-00f44928ff8f atomic
  • 3cfde62b-7c33-4b26-a61e-755d6131c8ce atomic
  • 42c55554-3dcb-4df6-8fbb-c8ccacc478d4 atomic
  • 43c3a49d-d15c-45e6-b303-f6e177e44a9a atomic
  • 46959285-906d-40fa-9437-5a439accd878 atomic
  • 51cde30c-0311-449a-8e15-542b59f95939 atomic
  • 520ce462-7ca7-441e-b5a5-f8347f632696 atomic
  • 5312c7c3-775b-4437-a8b0-914b30cfebd4 atomic
  • 5a668739-3a2f-4265-895f-c0e1e0b09eaa atomic
  • 5e417277-0ae7-4ad5-a3e8-0fa27c122b29 atomic
  • 75f66e03-37d3-4704-9520-3210efbe33ce atomic
  • 7617f689-bbd8-44bc-adcd-6f8968897848 atomic
  • 788e0019-a483-45da-bcfe-96353d46820f atomic
  • 78b274f8-acb0-428b-b1f7-7b0d0e73330a atomic
  • 78e95057-d429-4e66-8f82-0f060c1ac96f atomic
  • 7c247dc7-5128-4643-907b-73a76d9135c3 atomic
  • 864bb0b2-6bb5-489a-b43b-a77b3a16d68a atomic
  • 870fe8fb-5e23-4f5f-b89d-dd7fe26f3b5f atomic
  • 8f2765a8-e795-438b-a102-5e25a7adcce1 atomic
  • 922b1080-0b95-42b0-9585-b9a5ea0af044 atomic
  • 98618067-a2c7-4d4b-9c89-403a90f43656 atomic
  • 9d9c22c9-fa97-4008-a204-478cf68c40af atomic
  • 9e507bb8-1d30-4e3b-a49b-cb5727d7ea79 atomic
  • a11f22fb-a037-4cc2-bcfc-a133b287aa1b atomic
  • a8f6148d-478a-4f43-bc62-5efee9f931a4 atomic
  • aa12eb29-2dbb-414e-8b20-33d34af93543 atomic
  • … and 23 more in the database

Attack relationships

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-20-003partially-detectedatomiclinux2026-10-20
run-2026-10-20-004partially-detectedatomiclinux2026-10-20
run-2026-10-20-011partially-detectedatomicwindows2026-10-20
run-2026-10-25-001partially-detectedatomicwindows2026-10-25
run-2026-10-26-001detectedatomicwindows2026-10-26
run-2026-10-27-024detectedatomicwindows2026-10-27
run-2026-10-27-029partially-detectedatomiclinux2026-10-27
run-2026-10-27-030partially-detectedatomiclinux2026-10-27
run-2026-10-28-020detectedatomicwindows2026-10-28
run-2026-10-28-023partially-detectedatomiclinux2026-10-28
run-2026-10-28-024partially-detectedatomiclinux2026-10-28
run-2026-10-28-050detectedatomiclinux2026-10-28
run-2026-10-28-057detectedatomiclinux2026-10-28
  • run-2026-10-20-003 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=32). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90
  • run-2026-10-20-004 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90
  • run-2026-10-20-011 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=2712 max_level=15 dwell_s=90
  • run-2026-10-25-001 — Firing-proof re-detonation for deployed rule 100409. Rule matches reg.exe + query + (/f password-keyword paired with /t REG_SZ, or the PuTTY Sessions key). Proving the deployed regex fires on the live manager via a real agent->manager->indexer round-trip (logtest is eventchannel-blind).; expected=0 incidental=1810 max_level=15 dwell_s=90
  • run-2026-10-26-001 — Expect 100411 (Security 4688 arm, if_sid 67027) to land in the indexer bundle (_source.rule.id). Also check the benign-window FP measurement does NOT contain 100404 (the double-backslash FP regression). 100409 is expected NOT to fire (no Sysmon EID1).; expected=2 incidental=1778 max_level=15 dwell_s=90
  • run-2026-10-27-024 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=2 incidental=1810 max_level=15 dwell_s=90
  • run-2026-10-27-029 — Backlog detectability-baseline probe (priority 7, 2 corpus attack(s); atomic_tests=32). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90
  • run-2026-10-27-030 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90
  • run-2026-10-28-020 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=2 incidental=1721 max_level=15 dwell_s=90
  • run-2026-10-28-023 — Backlog detectability-baseline probe (priority 7, 2 corpus attack(s); atomic_tests=32). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90
  • run-2026-10-28-024 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90
  • run-2026-10-28-050 — Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=1 incidental=5 max_level=5 dwell_s=90
  • run-2026-10-28-057 — Backlog detectability-baseline probe (priority 7, 2 corpus attack(s); atomic_tests=32). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=1 incidental=8 max_level=6 dwell_s=90

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 339 of Cyber-Attack-Taxonomy.md
  • ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 1 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 10 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0005 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 23 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0006 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0007 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 41 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0008 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 5 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0009 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 6 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0010 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-003 (partially-detected) for T1552.001: no alert matched the expected technique
  • ev-0011 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-004 (partially-detected) for T1552.003: no alert matched the expected technique
  • ev-0012 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-011 (partially-detected) for T1552.002: no alert matched the expected technique
  • ev-0013 (Phase 4 detection lab - detonation runs 2026-10-25) — Lab detonation run-2026-10-25-001 (partially-detected) for T1552.002: no alert matched the expected technique
  • ev-0014 (Phase 4 detection lab - detonation runs 2026-10-26) — Lab detonation run-2026-10-26-001 (detected): Wazuh rule(s) 100411 fired on T1552.002 within the detonation window
    Credential hunting in the registry (Security 4688 arm): reg query recursively searching REG_SZ values for a password keyword, or enumerating saved PuTTY session credentials -- T1552.002
  • ev-0015 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-024 (detected): Wazuh rule(s) 100411 fired on T1552.002 within the detonation window
    Credential hunting in the registry (Security 4688 arm): reg query recursively searching REG_SZ values for a password keyword, or enumerating saved PuTTY session credentials -- T1552.002
  • ev-0016 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-029 (partially-detected) for T1552.001: no alert matched the expected technique
  • ev-0017 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-030 (partially-detected) for T1552.003: no alert matched the expected technique
  • ev-0018 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-020 (detected): Wazuh rule(s) 100411 fired on T1552.002 within the detonation window
    Credential hunting in the registry (Security 4688 arm): reg query recursively searching REG_SZ values for a password keyword, or enumerating saved PuTTY session credentials -- T1552.002
  • ev-0019 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-023 (partially-detected) for T1552.001: no alert matched the expected technique
  • ev-0020 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-024 (partially-detected) for T1552.003: no alert matched the expected technique
  • ev-0021 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-050 (detected): Wazuh rule(s) 100431 fired on T1552.003 within the detonation window
    Filesystem search tool (grep/find) executed -- possible unsecured-credential discovery -- T1552.003
  • ev-0022 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-057 (detected): Wazuh rule(s) 100430 fired on T1552.001 within the detonation window
    Credential-bearing file read via a shell reader (cat/grep/tail/... of a secrets/config file) -- unsecured credentials in files -- T1552.001