T1081.md

T1081 - Credentials in Files

Description from ATT&CK

Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

It is possible to extract passwords from backups or saved virtual machines through Credential Dumping. (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)

How to Detect

Simulating the attack

grep -riP password #{file_path}

grep -riP password /

Data sources required to detect the attack

auditlogs (audit.rules)

bash_history logs

Splunk Queries to detect the attack

auditlogs(syscalls)

index=linux sourcetype=linux_audit type=execve a0=grep password

bash_history

index=linux sourcetype="bash_history" grep password | table host,user_name,bash_command

Caution/Caveat