aol.pm

Unsecured Credentials

Technique · ATTACK:enterprise:T1552

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1552",
  "title": "Unsecured Credentials",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1552",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--435dfb86-2697-4867-85b5-2fef496c0517",
  "external_id": "T1552",
  "domain": "enterprise",
  "created": "2020-02-04T12:47:23.631Z",
  "modified": "2025-10-24T17:48:42.785Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Brining MimiKatz to Unix",
      "url": "https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf"
    }
  ]
}

Explicit source assertions (27)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:T1552.006 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00814703-3c3b-4872-89e9-cea4ba5edf2d

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--069ff8f0-889c-4463-bf5d-618bf5e457ee

ATTACK:enterprise:T1552.004 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0be618a0-f752-450f-8838-60c17fabd278

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1974c8c2-d97b-4ea3-9ed4-61a8d0cd2fdd

ADSecurity Finding Passwords in SYSVOL · MS14-025

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f29d292-9d2a-438d-8b8b-c9838e62b045

CISA Leviathan 2024

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--246e4d06-8646-4f9a-8d7c-1efd98fd11c1

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24956062-da03-4cb3-b8d8-9cb0e60344f7

AI-Mexico-Govt-Breach

ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b36db33-4f97-4228-bcca-4f453d1bd533

Microsoft MS14-025

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--529b0951-548c-4316-93d1-baf97d89f10a

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5401a61d-a795-4619-aa7e-fdf54cd4358e

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59f009e1-8175-439e-9fb1-6c37ae392307

Ensilo Darkgate 2018

ATTACK:enterprise:T1552.007 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b6ff1ab-eeca-43bc-8cd5-156bd8d3df8a

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6607178e-a8b4-4da9-b985-3712eb71a303

RedLock Instance Metadata API 2018

ATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d5cc26f-780f-4897-bae0-811e6b8bfa30

GitHub Pacu

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8497e912-185d-403b-865e-17c4b02290d2

ATTACK:enterprise:T1552.001 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--982441e5-d8f3-4b12-a765-4b503ce5db3b

ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa206b5b-9ea2-4f68-a4a0-4060e760c2cd

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abe43d10-714a-4f29-b164-d7cadd83cb61

ATTACK:enterprise:T1552.002 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adfeb8d8-1ce1-4abe-9861-21e2b26e8caa

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be30816a-854a-4568-ade5-8baa60fa087c

Cybereason Astaroth Feb 2019

ATTACK:enterprise:T1552.003 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c49f7336-749e-483b-8873-9283a377546d

ATTACK:enterprise:T1552.008 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6a3ab9f-8136-4965-a765-261d95b433e6

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf07a411-af81-4945-8c6f-511e04a978c2

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0718f47-ad79-4d04-a9d9-7bc97371a947

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S1131 → uses → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc434717-4497-4832-a1ff-d8f376022ff4

Huntress NPPSPY 2022

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e30864c0-df50-403b-9ad0-ef744a5d7449

ATTACK:enterprise:T1552.005 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd7ca8e8-82fc-443d-945a-fcef3352ec8a

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.