Unsecured Credentials
Unsecured credential discovery searches locations where secrets have been left readable.
What it means
Unsecured credential discovery searches locations where secrets have been left readable. Application configuration, scripts, and operational artifacts can expose powerful identities.
MITRE ATT&CK catalogs this behavior as T1552, within credential access. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A compromised host contains a configuration file with a service credential readable by the accessed user.
Evidence to examine
Review secret storage, permissions, access evidence, affected consumers, and subsequent use of the credential.
A common analytical pitfall
A secret's presence proves potential exposure but not that every observer used it.
Response considerations
Rotate or revoke exposed credentials according to evidence and risk and correct storage and permission weaknesses that created the exposure.
A secret can escape through ordinary work artifacts
A fictional deployment team places a service password in a configuration file and later attaches the file to a support ticket. The secret may be outside its intended access boundary even if the application itself uses authentication correctly. Repositories, scripts, environment files, notes, and logs can all become accidental credential stores.
Finding a secret-looking string requires validation through approved processes. It may be a placeholder, an expired test credential, or a live production secret. Do not try it against unrelated systems merely to discover whether it works. Identify the owner, intended use, and exposure scope without spreading the value further.
Removing the visible copy is usually insufficient for a live exposed credential. Copies may remain in history, backups, caches, or other recipients' storage. Rotation and revocation address continuing authority, while cleanup reduces future discovery. Both belong in the response when appropriate to the credential.
Follow a fictional configuration file
For a learning exercise, draw a secret from creation through deployment, debugging, ticket attachment, and archival. Mark where each reader gains access and which copies the team can actually remove. Use an obvious dummy value so the exercise cannot expose a real account.
Improve the workflow by using supported secret-management mechanisms, limiting service permissions, and preventing accidental logging or repository inclusion. Automated scanning can help detect exposure but needs ownership and a response process. A useful incident record identifies the credential type, affected service, time window, and completed invalidation without retaining the raw secret in ordinary prose. The goal is to remove unauthorized authority and prevent the same work process from exposing its replacement.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1552: Unsecured Credentials