aol.pm

Credentials In Files

Subtechnique · ATTACK:enterprise:T1552.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1552.001",
  "title": "Credentials In Files",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1552/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--837f9164-50af-4ac0-8219-379d8a74cefc",
  "external_id": "T1552.001",
  "domain": "enterprise",
  "created": "2020-02-04T12:52:13.006Z",
  "modified": "2026-09-11T19:22:30.399Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "CG 2014",
      "url": "http://carnal0wnage.attackresearch.com/2014/05/mimikatz-against-virtual-machine-memory.html"
    },
    {
      "source_name": "Unit 42 Hildegard Malware",
      "url": "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
    },
    {
      "source_name": "Unit 42 Unsecured Docker Daemons",
      "url": "https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/"
    },
    {
      "source_name": "Specter Ops - Cloud Credential Storage",
      "url": "https://posts.specterops.io/head-in-the-clouds-bd038bb69e48"
    },
    {
      "source_name": "SRD GPP",
      "url": "http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx"
    }
  ]
}

Explicit source assertions (49)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0117 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--044ad6d3-9389-4764-9b96-ad53dc98840d

Invincea XTunnel

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09c0536a-863f-4561-ad59-a5fa1c8daaa1

GitHub Pupy

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09c80e35-2839-4b5b-aad8-8f81db8da551

US-CERT Emotet Jul 2018 · CIS Emotet Dec 2018

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e46421a-6804-488e-adad-42cac34065be

GitHub PoshC2

ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e5b4489-d480-4f42-aadb-0eeb45ad6bc0

Talos Smoke Loader July 2018

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0eee3018-adc1-49b4-ac6b-12aae2b0f67e

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1448897c-4b9a-44ef-a0ce-371f98c1f2f3

Trend Micro SharePoint Attacks JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16952ba0-4fae-450b-990c-2b771efbd60f

Symantec Elfin Mar 2019 · FireEye APT33 Guardrail

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19821013-5844-46b3-82e9-189b4df07b9d

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0349 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--229150e3-5c4b-475e-8981-27fb472ad119

GitHub LaZagne Dec 2018

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3237c264-c70c-4fe4-9f53-a8709c3dd006

Github PowerShell Empire

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37dd2d5d-83c3-4d13-ac68-c1dd8f776c51

CISA Leviathan 2024

ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37eaf30d-7ea1-4c42-9b21-9739463aa15c

Aikido Shai-Hulud September 2025 · Netskope Shai-Hulud November 2025 · Palo Alto Unit 42 Shai-Hulud November 2025 · Socket Shai-Hulud November 2025 · Socket Shai-Hulud Trufflehog September 2025

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cf857dc-8e89-487c-b339-68517594bfc7

Flashpoint Mini Shai-Hulud MAY 2026 · Hunt.io TeamPCP Toolkit MAY 2026 · Trend Micro TeamPCP MAY 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e418cf0-fbe4-4de1-84bf-e137c5c0a72a

Unit42 Azorult Nov 2018

ATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49a1b876-8e1b-4ad0-be4e-d29c9a41833b

Huntress Kali365 Device Code June 2026

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bfd7ff0-f4a9-48f4-b5fb-1483dc74e760

CERT-FR PYSA April 2020

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dbf47c1-c065-4e4c-8894-376d636555a2

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50a1a87a-31cf-4a98-96f6-276f35798185

Unit 42 Hildegard Malware

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--580103be-ffce-4677-b24a-7092c1221ed0

Proofpoint TA505 Sep 2017

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b2f0fb3-5877-4fa2-bed1-1962423caccd

Trend Micro Trickbot Nov 2018 · Cyberreason Anchor December 2019 · TrendMicro Trickbot Feb 2019

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cd4af07-d10e-4034-84fc-b8256f08b5cd

AADInternals Documentation

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68e9977d-a765-45ad-91e9-42db7af8f990

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--752dc7ba-6ad9-42a7-a61a-4440bec0e1ea

Mandiant_UNC2165

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80dcd852-39c2-4ef9-a401-e54982010a65

Symantec Buckeye

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8658fc97-dc3a-4d39-8cb6-c0590b88cd14

Intel471_SH_Aug2021

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86847d37-f7da-4c30-ab48-2da87e6c1cff

Symantec Leafminer July 2018

ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87066d7b-b843-44dd-9146-027ffe19fae8

Anthropic AI Orchestrated Campaign NOV 2025

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--934be676-4444-4ab3-a411-dc9a8dc9c4bb

ATTACK:enterprise:T1552.001 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--982441e5-d8f3-4b12-a765-4b503ce5db3b

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a074c7b9-52f4-4fa4-b8df-74d0ed6ee430

Cyfirma_Vidar_June2024 · Intrinsec_Vidar_April2026 · LevelBlue_Vidar_May2026 · Unit42_Vidar_July2026

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a628def4-31a4-475e-b4b8-615534d8d585

GitHub QuasarRAT · Volexity Patchwork June 2018

ATTACK:enterprise:S0067 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6e4853a-78a6-4c88-a7c5-58793d3e4dcd

CrowdStrike Putter Panda

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a89c60cc-5851-45bf-bcd6-f73f460351a5

Netscout Stolen Pencil Dec 2018

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aec49e52-c54e-45be-a476-70aa0dc42cfb

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5526d4d-5374-4642-ba95-bdd1bfe45849

Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · FBI TeamPCP JUL 2026 · Google AI Threat Tracker MAY 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1108137-b707-4358-b4b2-b2f139418f7e

Kaspersky Adwind Feb 2016

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8909d65-f9e1-41ba-a9d9-c47dbf03d588

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d705df92-50a0-4810-a893-979f73c6cdc8

FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · FireEye APT35 2018 · Unit42 OilRig Playbook 2023

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dac6c0a0-9eba-41b5-95c1-2f340d12b175

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de1f960b-9f59-4113-8e07-bdb534303ab0

CISA GRU29155 2024

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--deddda4d-6ce3-4531-aaea-b7b049597a22

DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023

ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e15c0df7-503b-4089-a333-c311ab782ea4

Black Hills Information Security TruffleHog January 2024 · Netskope Shai-Hulud November 2025

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e830611d-a7c5-446c-a5a7-ec1062bb3f53

Cado Security TeamTNT Worm August 2020 · Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee05131d-83bd-4eb5-b6c1-0f6925045b95

Symantec MuddyWater Dec 2018

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f340429c-d29e-4bd5-9458-67399e695c1f

AI-Mexico-Govt-Breach

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4ac7555-2b20-4345-998e-6ffc462cab03

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9234d49-433d-41b2-ac26-7e9c899e6076

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fab558cd-cb4a-4e7a-a3c7-184bee680019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.