Patchfirst
Patchfirst
T1552.001Credential Access

Credentials In Files

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords…

attack.mitre.org ↗
CVEs10
In 6
Reports1

Detections

24 Sigma rules tagged T1552.001
Credentials In FilesT1552.00124 general rules
All 24 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Credentials In Files

10 CVEs, by priority. Each link shows its badge.
  1. CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
    Ivanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1133External Remote ServicesT1059Command and Scripting Interpreter+2 more · 6 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    90.0priority
  2. CVE-2022-26138Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
    Atlassian · ConfluenceKEVPublic exploitCritical · 9.8T1552.001Credentials In Files1 report
    MITRE CTID mapping of the KEV entry · how it is exploited
    98.2%Top 0.08%
    83.7priority
  3. CVE-2026-33634Aquasecurity Trivy Embedded Malicious Code Vulnerability
    Aquasecurity · TrivyKEVPublic exploitHigh · 8.8T1195.002Compromise Software Supply ChainT1552.001Credentials In Files2 reports
    AI mapping from the description · primary impact
    59.7%Top 0.87%
    80.1priority
  4. CVE-2024-57727SimpleHelp Path Traversal Vulnerability
    SimpleHelp · SimpleHelpKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+3 more
    MITRE CTID mapping of the KEV entry · primary impact
    96.8%Top 0.11%
    78.2priority
  5. CVE-2025-30066tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
    tj-actions · changed-files GitHub ActionKEVPublic exploitHigh · 8.6T1195.002Compromise Software Supply ChainT1552.001Credentials In Files
    AI mapping from the description · primary impact
    72.1%Top 0.57%
    68.9priority
  6. CVE-2025-30154reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
    reviewdog · action-setup GitHub ActionKEVPublic exploitHigh · 8.6T1195.002Compromise Software Supply ChainT1552.001Credentials In Files
    AI mapping from the description · primary impact
    2.5%Top 15%
    65.9priority
  7. CVE-2020-3240Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
    Cisco · Cisco UCS DirectorCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+4 more
    MITRE CTID mapping of the CVE · follow-on activity
    38.7%Top 1.4%
    26.6priority
  8. CVE-2019-3780Cloud Foundry Container Runtime Leaks IAAS Credentials
    Cloud Foundry · Cloud Foundry Container Runtime (CFCR)Critical · 9.1T1068Exploitation for Privilege EscalationT1552.001Credentials In Files
    MITRE CTID mapping of the CVE · primary impact
    1.4%Top 27%
    21.0priority
  9. CVE-2018-7520An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline…
    Geutebrück · Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmwareT1552.001Credentials In Files
    MITRE CTID mapping of the CVE · primary impact
    1.6%Top 25%
    15.1priority
  10. CVE-2019-3782CredHub CLI writes environment variable credentials to disk
    Cloud Foundry · CredHub CLIMedium · 6.3T1098Account ManipulationT1552.001Credentials In Files
    MITRE CTID mapping of the CVE · primary impact
    0.4%Top 71%
    10.3priority

Passages that support these links

↑ ↓ chooseEnter openEsc close