T1552: Unsecured Credentials
AI Answer
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)). (Source: MITRE ATT&CK T1552)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1552 |
| Name | Unsecured Credentials |
| Tactic | Credential Access (credential-access) |
| Platforms | Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Unsecured Credentials (T1552) is one of the highest-connectivity ATT&CK techniques: 6 MITRE STIX relationships reference this technique; 1 threat groups observed using it; 4 software families associated; 1 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1552). Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- DarkGate
- Astaroth
- NPPSPY
- Pacu
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Volt Typhoon
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Leviathan Australian Intrusions
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1552 Unsecured Credentials. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1552 Unsecured Credentials?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.