Home/ MITRE Matrix/ Credential Access/ T1552

T1552Unsecured Credentials

T1552 — Unsecured Credentials is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 17 detection use cases covering it and 6 threat-intel articles citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

17Use cases

6Articles

8Sub-techniques

1Tactic

Sub-techniques (8)

T1552.008 · Chat Messages T1552.005 · Cloud Instance Metadata API T1552.007 · Container API T1552.001 · Credentials In Files T1552.002 · Credentials in Registry T1552.006 · Group Policy Preferences T1552.004 · Private Keys T1552.003 · Shell History

Use cases covering this technique (17)

GCP service-account key created Internal actions · alerting DD GitHub personal access token created Internal actions · alerting DD GitHub personal access token cloning many repositories Internal actions · alerting DD Splunk Sensitive Information Disclosure in DEBUG Logging Channels ESCU actions · hunting P Detect AWS Console Login by New User ESCU actions · hunting P O365 Email Suspicious Search Behavior ESCU actions · hunting P O365 SharePoint Suspicious Search Behavior ESCU actions · hunting P Windows LAPS Password Gathering Via PowerShell Script ESCU actions · hunting P Windows Post Exploitation Risk Behavior ESCU actions · alerting P Windows Unsecured Outlook Credentials Access In Registry ESCU actions · hunting P Cisco SNMP Community String Configuration Changes ESCU actions · hunting P Windows SharePoint Spinstall0 GET Request ESCU actions · alerting P [LLM] Cloud instance-metadata (IMDS 169.254.169.254) credential theft by interpreter/shell in pipeline pod Bespoke actions · alerting DSΣDDCS [LLM] Budibase server leaks datasource auth to first-seen host (undici + Authorization egress) Bespoke actions · hunting SP [LLM] Runner.Worker process memory scrape via /proc on self-hosted GitHub Actions runner Bespoke actions · alerting DSΣPDDCS [LLM] CodeCov Bash Uploader CI env-var exfiltration via curl (<<<<<< ENV marker) Bespoke actions · alerting DSΣPDDCS [LLM] Access to exposed Elector '/get-admin-users' credential-leaking API endpoint Bespoke exploit · alerting SΣP

Articles citing this technique (6)

crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach art-27

crit [GHSA / CRITICAL] GHSA-mqhr-6j6h-74p5: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak art-83

crit [GHSA / CRITICAL] CVE-2026-44935: Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in H art-268

high simonecorsi/mawesome GitHub Action has been compromised art-275

high Responsible disclosure: CodeCov CEO & CTO share learnings from the breach art-2750

med Security breach leaks the personal data of all 6.5 million Israeli voters art-3418