Credential Access

T1552 — Unsecured Credentials

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g...

Investigate Unsecured Credentials activity in the context of Credential Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

Platforms

Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider

Priority / status

medium / complete

Evidence to collect

Host or resource affected
Account or identity involved
Timestamp of the activity
Related process, file, or network artifact
Any preceding or follow-on alerts

ATT&CK Technique	D3FEND Technique	Practical SOC Action	Tooling
T1552 Unsecured Credentials	File Analysis	Monitor for File Analysis indicators relevant to this technique.	Defender for Endpoint
T1552 Unsecured Credentials	File Encryption	Apply File Encryption to reduce this technique's viability before an incident occurs.	Defender for Endpoint
T1552 Unsecured Credentials	File Eviction	Use File Eviction to remove the adversary's foothold once this technique is confirmed.	Defender for Endpoint
T1552 Unsecured Credentials	Content Filtering	Apply Content Filtering to contain the blast radius once this technique is observed.	Defender for Endpoint

T1552 Unsecured Credentials → D3FEND → SOC action

Investigation steps — Microsoft

Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
Check Sentinel analytics rules and incidents correlated with this technique.
Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

Investigation steps — generic

Confirm whether the observed unsecured credentials activity matches expected administrative or application behaviour.
Identify the host, account, or resource where the activity occurred and its business criticality.
Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.
Real detection reference: "Credentials in Files or Environment Variables" -- Flags command-line searches for plaintext credentials in files, config files, or environment variables - a common post-exploitation step to find lateral movement or cloud escalation credentials.

Response actions

Action	Risk	Automation safe	Approval required
Rotate any credentials that may have been exposed	Medium	No	Yes
Remediate the underlying misconfiguration — credentials shou	Low	No	Yes
Implement secrets management (Azure Key Vault, HashiCorp Vau	Low	No	Yes

KQL

GEN-CA-006 — Credentials in Files or Environment Variables

DeviceProcessEvents
| where TimeGenerated >= ago(15m)
| where (FileName in~ ("findstr.exe", "rg.exe") and ProcessCommandLine has_any (
        "password", "passwd", "credential", "secret", "api_key", "apikey", "token", "connectionstring",
        "pwd=", "pass=", "username=", "user=", "login="
    ))
    or (FileName in~ ("cmd.exe", "powershell.exe") and ProcessCommandLine has_any (
        ".env", "credentials", "secrets.json", "accessTokens", "config.json", "web.config",
        ".aws/credentials", ".azure", "vault", "keystore"
    ) and ProcessCommandLine has_any ("type ", "cat ", "gc ", "Get-Content", "more "))
    or (FileName =~ "powershell.exe" and ProcessCommandLine has_any (
        "Get-ChildItem Env:", "[Environment]::GetEnvironmentVariable", "$env:", "dir env:"
    ) and ProcessCommandLine has_any ("password", "secret", "key", "token"))
| project
    TimeGenerated,
    DeviceName,
    AccountName,
    FileName,
    ProcessCommandLine,
    SHA256
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc

cfc1ae62-db63-4a3e-b88b-dc04030c2257 — AD FS Abnormal EKU object identifier attribute

// change the starttime value for a longer period of known OIDs
let starttime = 1d;
// change the lookback value for a longer period of lookback for suspicious/abnormal
let lookback = 1h;
let OIDList = SecurityEvent
| where TimeGenerated >= ago(starttime)
| where EventSourceName == 'AD FS Auditing'
| where EventID == 501
| where EventData has '/eku'
| extend OIDs = extract_all(@"<Data>([\d+\.]+)</Data>", EventData)
| mv-expand OIDs
| extend OID = tostring(OIDs)
| extend OID_Length = strlen(OID)
| project TimeGenerated, Computer, EventSourceName, EventID, OID, OID_Length, EventData
;
OIDList
| where TimeGenerated >= ago(lookback)
| join kind=leftanti (
OIDList
| where TimeGenerated between (ago(starttime) .. ago(lookback))
| summarize by OID
) on OID
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)

2e3c4ad5-8cb3-4b46-88ff-a88367ee7eaa — Password Exfiltration over SCIM application

Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "Password Exfiltration over SCIM application"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics

Escalation criteria

Unsecured Credentials activity observed on a privileged account or critical system.
Activity follows or precedes other suspicious behaviour in the same investigation.
Automated triage cannot confidently rule out malicious intent.

False positive considerations

Legitimate administrative or maintenance activity matching this pattern.
Approved security testing or red team exercise.
Known benign software producing similar telemetry.

View Markdown Download Markdown

# T1552 - Unsecured Credentials

## SOC Recommendation
Investigate Unsecured Credentials activity in the context of Credential Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Rotate any credentials that may have been exposed | Medium | No | Yes |
| Remediate the underlying misconfiguration — credentials shou | Low | No | Yes |
| Implement secrets management (Azure Key Vault, HashiCorp Vau | Low | No | Yes |

## KQL
```kql
DeviceProcessEvents
| where TimeGenerated >= ago(15m)
| where (FileName in~ ("findstr.exe", "rg.exe") and ProcessCommandLine has_any (
        "password", "passwd", "credential", "secret", "api_key", "apikey", "token", "connectionstring",
        "pwd=", "pass=", "username=", "user=", "login="
    ))
    or (FileName in~ ("cmd.exe", "powershell.exe") and ProcessCommandLine has_any (
        ".env", "credentials", "secrets.json", "accessTokens", "config.json", "web.config",
        ".aws/credentials", ".azure", "vault", "keystore"
    ) and ProcessCommandLine has_any ("type ", "cat ", "gc ", "Get-Content", "more "))
    or (FileName =~ "powershell.exe" and ProcessCommandLine has_any (
        "Get-ChildItem Env:", "[Environment]::GetEnvironmentVariable", "$env:", "dir env:"
    ) and ProcessCommandLine has_any ("password", "secret", "key", "token"))
| project
    TimeGenerated,
    DeviceName,
    AccountName,
    FileName,
    ProcessCommandLine,
    SHA256
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
// change the starttime value for a longer period of known OIDs
let starttime = 1d;
// change the lookback value for a longer period of lookback for suspicious/abnormal
let lookback = 1h;
let OIDList = SecurityEvent
| where TimeGenerated >= ago(starttime)
| where EventSourceName == 'AD FS Auditing'
| where EventID == 501
| where EventData has '/eku'
| extend OIDs = extract_all(@"<Data>([\d+\.]+)</Data>", EventData)
| mv-expand OIDs
| extend OID = tostring(OIDs)
| extend OID_Length = strlen(OID)
| project TimeGenerated, Computer, EventSourceName, EventID, OID, OID_Length, EventData
;
OIDList
| where TimeGenerated >= ago(lookback)
| join kind=leftanti (
OIDList
| where TimeGenerated between (ago(starttime) .. ago(lookback))
| summarize by OID
) on OID
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
```
```kql
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "Password Exfiltration over SCIM application"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
```

## Escalation Criteria
- Unsecured Credentials activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1552.json

Response:

{
  "technique_id": "T1552",
  "name": "Unsecured Credentials",
  "priority": "medium",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Credential Access"
  ],
  "platforms": [
    "Windows",
    "SaaS",
    "IaaS",
    "Linux",
    "macOS",
    "Containers",
    "Network Devices",
    "Office Suite",
    "Identity Provider"
  ],
  "summary": "Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g...",
  "soc_recommendation": "Investigate Unsecured Credentials activity in the context of Credential Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CF",
      "name": "Content Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Content Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed unsecured credentials activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Credentials in Files or Environment Variables\" -- Flags command-line searches for plaintext credentials in files, config files, or environment variables - a common post-exploitation step to find lateral movement or cloud escalation credentials."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Rotate any credentials that may have been exposed",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Remediate the underlying misconfiguration — credentials shou",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Remediate the underlying misconfiguration — credentials should never be in plaintext files"
    },
    {
      "name": "Implement secrets management (Azure Key Vault, HashiCorp Vau",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Implement secrets management (Azure Key Vault, HashiCorp Vault)"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CA-006 — Credentials in Files or Environment Variables",
        "description": "Flags command-line searches for plaintext credentials in files, config files, or environment variables - a common post-exploitation step to find lateral movement or cloud escalation credentials. (Source: Bell Integration baseline detection library, mapped via sub-technique T1552.001.)",
        "query": "DeviceProcessEvents\n| where TimeGenerated >= ago(15m)\n| where (FileName in~ (\"findstr.exe\", \"rg.exe\") and ProcessCommandLine has_any (\n        \"password\", \"passwd\", \"credential\", \"secret\", \"api_key\", \"apikey\", \"token\", \"connectionstring\",\n        \"pwd=\", \"pass=\", \"username=\", \"user=\", \"login=\"\n    ))\n    or (FileName in~ (\"cmd.exe\", \"powershell.exe\") and ProcessCommandLine has_any (\n        \".env\", \"credentials\", \"secrets.json\", \"accessTokens\", \"config.json\", \"web.config\",\n        \".aws/credentials\", \".azure\", \"vault\", \"keystore\"\n    ) and ProcessCommandLine has_any (\"type \", \"cat \", \"gc \", \"Get-Content\", \"more \"))\n    or (FileName =~ \"powershell.exe\" and ProcessCommandLine has_any (\n        \"Get-ChildItem Env:\", \"[Environment]::GetEnvironmentVariable\", \"$env:\", \"dir env:\"\n    ) and ProcessCommandLine has_any (\"password\", \"secret\", \"key\", \"token\"))\n| project\n    TimeGenerated,\n    DeviceName,\n    AccountName,\n    FileName,\n    ProcessCommandLine,\n    SHA256\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "cfc1ae62-db63-4a3e-b88b-dc04030c2257 — AD FS Abnormal EKU object identifier attribute",
        "description": "This detection uses Security events from the \"AD FS Auditing\" provider to detect suspicious object identifiers (OIDs) as part EventID 501 and specifically part of the Enhanced Key Usage attributes. This query checks to see if you have any new OIDs in the last hour that have not been seen in the previous day. New OIDs should be validated and OIDs that are very long, as indicated by the OID_Length field, could also be an indicator of malicious activity. In order to use this query you need to enable AD FS auditing on the AD FS Server. References: https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/ https://docs.microsoft.com/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging ' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "// change the starttime value for a longer period of known OIDs\nlet starttime = 1d;\n// change the lookback value for a longer period of lookback for suspicious/abnormal\nlet lookback = 1h;\nlet OIDList = SecurityEvent\n| where TimeGenerated >= ago(starttime)\n| where EventSourceName == 'AD FS Auditing'\n| where EventID == 501\n| where EventData has '/eku'\n| extend OIDs = extract_all(@\"<Data>([\\d+\\.]+)</Data>\", EventData)\n| mv-expand OIDs\n| extend OID = tostring(OIDs)\n| extend OID_Length = strlen(OID)\n| project TimeGenerated, Computer, EventSourceName, EventID, OID, OID_Length, EventData\n;\nOIDList\n| where TimeGenerated >= ago(lookback)\n| join kind=leftanti (\nOIDList\n| where TimeGenerated between (ago(starttime) .. ago(lookback))\n| summarize by OID\n) on OID\n| extend HostName = tostring(split(Computer, \".\")[0]), DomainIndex = toint(indexof(Computer, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)"
      },
      {
        "name": "2e3c4ad5-8cb3-4b46-88ff-a88367ee7eaa — Password Exfiltration over SCIM application",
        "description": "This rule detects suspicious sync events that occurred to applications using SCIM for user provisioning. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "Authomize_v2_CL\n| where ingestion_time() >= ago(30m)\n| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s\n| where Policy has \"Password Exfiltration over SCIM application\"\n| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "b8e4c2a1-7f3d-4e9b-8c5a-1d0e6f2a4b8c — Potential Credential Discovery via Recursive Grep",
        "description": "(ESQL) Identifies recursive grep activity on Linux or macOS where the command line suggests hunting for secrets, credentials, keys, tokens, or sensitive paths (for example .env, .git, .aws)... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-endpoint.events.process-* metadata _id, _version, _index\n| where host.os.type in (\"linux\", \"macos\")\n  and event.category == \"process\"\n  and process.name in (\"grep\", \"egrep\")\n  and (to_lower(process.command_line) like \"* -r*\" or to_lower(process.command_line) like \"*--recursive*\")\n  and (\n    process.command_line like \"*password*\"\n    or process.command_line like \"*passwd*\"\n    or process.command_line like \"*pwd*\"\n    or process.command_line like \"*secret*\"\n    or process.command_line like \"*token*\"\n    or process.command_line like \"*apikey*\"\n    or process.command_line like \"*api_key*\"\n    or process.command_line like \"*api.key*\"\n    or process.command_line like \"*access_key*\"\n    or process.command_line like \"*private_key*\"\n    or process.command_line like \"*client_secret*\"\n    or process.command_line like \"*credential*\"\n    or process.command_line like \"*auth*\"\n    or process.command_line like \"*bearer*\"\n    or process.command_line like \"*BEGIN*PRIVATE*KEY*\"\n    or process.command_line like \"*ssh-rsa*\"\n    or process.command_line like \"*ghp_*\"\n    or process.command_line like \"*github_pat*\"\n    or process.command_line like \"*xoxb-*\"\n    or process.command_line like \"*hooks.slack.com*\"\n    or process.command_line like \"*discord.com/api/webhooks*\"\n    or process.command_line like \"*/.aws/*\"\n    or process.command_line like \"*/.git/*\"\n    or process.command_line like \"*/.env*\"\n  )\n  and (process.parent.command_line is null or not (to_lower(process.parent.command_line) like \"*shell-snapshots*\" and process.parent.name in (\"bash\", \"sh\", \"zsh\")))\n| eval Esql.time_bucket = date_trunc(1 minute, @timestamp)\n| stats Esql.unique_cmd = count_distinct(process.command_line),\n        Esql.cmd_values = values(process.command_line),\n        Esql.pcmd_values = values(process.parent.command_line)\n  by process.name, host.id, host.name, agent.id, process.parent.name, user.name, Esql.time_bucket\n| where Esql.unique_cmd >= 3\n| keep host.id, host.name, agent.id, user.name, process.parent.name, Esql.*"
      },
      {
        "name": "2b9a3b7a-0891-4a89-abbe-dca753c403cd — Multi-Cloud CLI Token and Credential Access Commands",
        "description": "(ESQL) Correlates process telemetry for shells and major cloud/Kubernetes CLIs when command lines match token or credential material access patterns (GCP, Azure, AWS, GitHub, kubectl, DigitalOcean, OCI). Flags hosts where multiple cloud targets appear within a five-minute window. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-endpoint.events.process-*, logs-system.security-*, logs-windows.sysmon_operational-* METADATA _id, _index, _version\n| WHERE event.category == \"process\" AND KQL(\"\"\" event.type : \"start\" and not event.action : \"fork\" \"\"\")\n  AND process.command_line IS NOT NULL \n  AND (\n    TO_LOWER(process.name) IN (\n      \"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \n      \"sh\", \"bash\", \"zsh\", \"dash\", \"fish\", \"ksh\",\n      \"gcloud\", \"gcloud.cmd\", \"az\", \"az.cmd\", \"azd\", \"azd.exe\",\n      \"gh\", \"gh.exe\", \"aws\", \"aws.exe\",\n      \"kubectl\", \"kubectl.exe\",\n      \"doctl\", \"doctl.exe\",\n      \"oci\", \"oci.exe\"\n    ) OR\n    TO_LOWER(process.parent.name) IN (\n      \"cmd.exe\", \"powershell.exe\", \"pwsh.exe\",\n      \"sh\", \"bash\", \"zsh\", \"dash\", \"fish\", \"ksh\", \"bun\", \"bun.exe\", \n      \"node\", \"node.exe\", \"java\", \"java.exe\"\n    )\n  )\n  AND process.command_line RLIKE \"\"\".*(config-helper\\s.*--format|auth\\s+print-access-token|auth\\s+print-identity-token|auth\\s+application-default\\s+print|get-access-token\\s.*--output|Get-AzAccessToken|azd\\s+auth\\s+token|az\\s+account\\s+get-access-token|gh\\s+auth\\s+(token|status)|aws\\s+sts\\s+(get-session-token|get-caller-identity|assume-role)|aws\\s+configure\\s+(export-credentials|list)|kubectl\\s+config\\s+view\\s.*--raw|kubectl\\s+get\\s+secret|doctl\\s+auth\\s+(list|init)|oci\\s+session\\s+authenticate|oci\\s+iam\\s.*token).*\"\"\"\n| EVAL cloud_target = CASE(\n    process.command_line RLIKE \".*(gcloud|config-helper|print-access-token|print-identity-token).*\", \"GCP\",\n    process.command_line RLIKE \".*(azd auth|az account|Get-AzAccessToken).*\", \"AZURE\",\n    process.command_line RLIKE \".*(aws sts|aws configure).*\", \"AWS\",\n    process.command_line RLIKE \".*(gh auth).*\", \"GITHUB\",\n    process.command_line RLIKE \".*(kubectl config|kubectl get secret).*\", \"KUBERNETES\",\n    process.command_line RLIKE \".*(doctl).*\", \"DIGITALOCEAN\",\n    process.command_line RLIKE \".*(oci session|oci iam).*\", \"ORACLE\"\n  )\n| WHERE cloud_target IS NOT NULL // drop unclassified events before aggregation\n| STATS\n    Esql.cloud_targets = VALUES(cloud_target),\n    Esql.unique_clouds = COUNT_DISTINCT(cloud_target),\n    Esql.process_command_line_values = VALUES(process.command_line),\n    Esql.process_parent_executable_values = VALUES(process.parent.executable),\n    Esql.first_seen = MIN(@timestamp),\n    Esql.last_seen = MAX(@timestamp),\n    Esql.event_count = COUNT(*)\n  BY host.name, host.id, user.name\n| WHERE Esql.unique_clouds >= 2\n| KEEP Esql.*, user.name, host.name, host.id"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Unsecured Credentials activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1552 - Unsecured Credentials Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}