Techniques › T1552.001 › AN0857
AN0857 Analytic 0857
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>File reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.</p>
- Detects
- T1552.001 Credentials In Files
- Part of
- DET0307 Detect Access to Unsecured Credential Files Across Platforms
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open/read of sensitive config or secret files | DC0055 File Access |
| auditd:EXECVE | grep/cat/awk on files with password fields | DC0064 Command Execution |
| linux:syslog | authentication success after file access | DC0067 Logon Session Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
RegexPatterns | Patterns like password, secret, token can be expanded or customized |
UserContextScope | Scope of users monitored (e.g., root vs all users) |
TimeWindow | Time between suspicious file access and credential use |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2019-11510 | Ivanti Pulse Connect Secure | Mapped |
| CVE-2022-26138 | Atlassian Confluence | Mapped |
| CVE-2024-57727 | SimpleHelp SimpleHelp | Mapped |