Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Credential Access/ T1552

T1552Unsecured Credentials

T1552 — Unsecured Credentials is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 19 detection use cases covering it and 6 threat-intel articles citing it.

Credential Access
View on the matrix → Filter Detection Library MITRE official spec ↗
19Use cases
6Articles
8Sub-techniques
1Tactic

Sub-techniques (8)

T1552.008 · Chat MessagesT1552.005 · Cloud Instance Metadata APIT1552.007 · Container APIT1552.001 · Credentials In FilesT1552.002 · Credentials in RegistryT1552.006 · Group Policy PreferencesT1552.004 · Private KeysT1552.003 · Shell History

Use cases covering this technique (19)

GCP service-account key created Internal actions · alerting DD GitHub personal access token created Internal actions · alerting DD GitHub personal access token cloning many repositories Internal actions · alerting DD [WEEKLY] SSRF-Driven Secret Egress: Public-Facing App Reaches Cloud Metadata/Attacker Host Internal actions · alerting DSΣPDDCSCW Splunk Sensitive Information Disclosure in DEBUG Logging Channels ESCU actions · hunting P Detect AWS Console Login by New User ESCU actions · hunting P O365 Email Suspicious Search Behavior ESCU actions · hunting P O365 SharePoint Suspicious Search Behavior ESCU actions · hunting P Windows LAPS Password Gathering Via PowerShell Script ESCU actions · hunting P Windows Post Exploitation Risk Behavior ESCU actions · alerting P Windows Unsecured Outlook Credentials Access In Registry ESCU actions · hunting P Cisco SNMP Community String Configuration Changes ESCU actions · hunting P Windows SharePoint Spinstall0 GET Request ESCU actions · alerting P [LLM] Access to Flowise credential store /root/.flowise and secret env vars Bespoke actions · hunting DSΣPDDCS [LLM] flyto-verification runner egress to external public host — FLYTO_RUNNER_SECRET exfiltration Bespoke actions · hunting DSPDDCS [LLM] Budibase server leaks datasource auth to first-seen host (undici + Authorization egress) Bespoke actions · hunting SP [LLM] Runner.Worker process memory scrape via /proc on self-hosted GitHub Actions runner Bespoke actions · alerting DSΣPDDCS [LLM] CodeCov Bash Uploader CI env-var exfiltration via curl (<<<<<< ENV marker) Bespoke actions · alerting DSΣPDDCS [LLM] Access to exposed Elector '/get-admin-users' credential-leaking API endpoint Bespoke exploit · alerting SΣP

Articles citing this technique (6)

crit [GHSA / CRITICAL] CVE-2026-69255: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified art-128
crit [GHSA / CRITICAL] CVE-2026-67426: Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltr art-167
crit [GHSA / CRITICAL] GHSA-mqhr-6j6h-74p5: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak art-199
high simonecorsi/mawesome GitHub Action has been compromised art-330
high Responsible disclosure: CodeCov CEO & CTO share learnings from the breach art-2773
med Security breach leaks the personal data of all 6.5 million Israeli voters art-3441