ENTERPRISE MOBILE PRE-ATT&CK
TECHNIQUES
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact
  1. Home
  2. Techniques
  3. Enterprise
  4. Credentials in Files

Credentials in Files

Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

It is possible to extract passwords from backups or saved virtual machines through Credential Dumping. [1] Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. [2]

In cloud environments, authenticated user credentials are often stored in local configuration and credential files. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files. [3]

ID: T1081
Tactic: Credential Access
Platform: Linux, macOS, Windows, AWS, GCP, Azure
System Requirements: Access to files
Permissions Required: User, Administrator, SYSTEM
Data Sources: File monitoring, Process command-line parameters
CAPEC ID: CAPEC-639
Contributors: Microsoft Threat Intelligence Center (MSTIC)
Version: 1.1

Procedure Examples

Name Description
APT3

APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.[27]
Azorult

Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.[13]
BlackEnergy

BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.[16][17]
Emotet

Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.[22][23]
Empire

Empire can use various modules to search for files containing passwords.[10]
jRAT

jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.[24]
Kimsuky

Kimsuky has used a Google Chrome extension to steal passwords and cookies from their browsers.[31]
LaZagne

LaZagne can obtain credentials from browsers, chats, databases, mail, and WiFi.[9]
Machete

Machete exfiltrates the files "key3.db" and "signons.sqlite", which store passwords, from several browsers. [25]
Mimikatz

Mimikatz's DPAPI module can harvest protected credentials stored and/or cached by browsers and other user applications by interacting with Windows cryptographic application programming interface (API) functions.[7][8]
MuddyWater

MuddyWater has run a tool that steals passwords saved in victim email.[26]
OilRig

OilRig has used tools named VALUEVAULT and PICKPOCKET to dump passwords from web browsers. [32]
Olympic Destroyer

Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.[21]
pngdowner

If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.[20]
PoshC2

PoshC2 contains modules for searching for passwords in local and remote files.[11]
Proton

Proton gathers credentials in files for 1password, and keychains.[19]
QuasarRAT

QuasarRAT can obtain passwords from FTP clients.[5][6]
Smoke Loader

Smoke Loader searches for files named logins.json to parse for credentials.[18]
Stolen Pencil

Stolen Pencil has used tools that are capable of obtaining credentials from saved mail.[28]
TA505

TA505 has used malware to gather credentials from FTP clients and Outlook.[29]
TrickBot

TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.[14][15]
Turla

Turla has gathered credentials from the Windows Credential Manager tool. [30]
XTunnel

XTunnel is capable of accessing locally stored passwords on victims.[12]

Mitigations

Mitigation Description
Active Directory Configuration

Remove vulnerable Group Policy Preferences.[4]
Audit

Preemptively search for files containing passwords and take actions to reduce the exposure risk when found.
Password Policies

Establish an organizational policy that prohibits password storage in files.
Restrict File and Directory Permissions

Restrict file shares to specific directories with access only to necessary users.
User Training

Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.

Detection

While detecting adversaries accessing these files may be difficult without knowing they exist in the first place, it may be possible to detect adversary use of credentials they have obtained. Monitor the command-line arguments of executing processes for suspicious words or regular expressions that may indicate searching for a password (for example: password, pwd, login, secure, or credentials). See Valid Accounts for more information.

References

  1. CG. (2014, May 20). Mimikatz Against Virtual Machine Memory Part 1. Retrieved November 12, 2014.
  2. Security Research and Defense. (2014, May 13). MS14-025: An Update for Group Policy Preferences. Retrieved January 28, 2015.
  3. Maddalena, C.. (2018, September 12). Head in the Clouds. Retrieved October 4, 2019.
  4. Microsoft. (2014, May 13). MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege. Retrieved January 28, 2015.
  5. MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.
  6. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.
  7. Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz & Command Reference. Retrieved December 23, 2015.
  8. Grafnetter, M. (2015, October 26). Retrieving DPAPI Backup Keys from Active Directory. Retrieved December 19, 2017.
  9. Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018.
  10. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  11. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  12. Belcher, P.. (2016, July 28). Tunnel of Gov: DNC Hack and the Russian XTunnel. Retrieved August 3, 2016.
  13. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
  14. Anthony, N., Pascual, C.. (2018, November 1). Trickbot Shows Off New Trick: Password Grabber Module. Retrieved November 16, 2018.
  15. Llimos, N., Pascual, C.. (2019, February 12). Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire. Retrieved March 12, 2019.
  16. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  1. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.
  2. Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.
  3. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  4. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  5. Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
  6. US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.
  7. CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.
  8. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  9. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  10. Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.
  11. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.
  12. ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019.
  13. Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019.
  14. Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.
  15. Cimpanu, C.. (2018, December 5). Cyber-espionage group uses Chrome extension to infect victims. Retrieved August 26, 2019.
  16. Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019.