Unsecured Credentials `T1552`

Tactic: Credential Access

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Events covered

24 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4648	A logon was attempted using explicit credentials.
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4662	An operation was performed on an object.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4690	An attempt was made to duplicate a handle to an object.
ESF	exec	Process Execution (Notify)
ESF	open	File Open (NOTIFY)
ESF	create	File or Directory Create (NOTIFY)
ESF	write	File Write (NOTIFY)
Linux-Auditd	Event ID 1309	EXECVE
CertificateServicesClient-Lifecycle-System	Event ID 1007	A certificate has been exported.
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

Patterns shared across the 219 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (185 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`CommandLine`	46	`contains` 39, `wildcard` 6, `regex_match` 3, `in` 2, `match` 2, `is_not_null` 1	`\sysvol\`, `--results=verified`, `confluence` , `docker --image` , `ntevent`
`process_name`	38	`in` 16, `eq` 15, `starts_with` 5, `regex_match` 4, `match` 1, `ne` 1, `wildcard` 1	`bash`, `awk`, `.`, `busybox`, `cat`
`EventType`	37	`eq` 24, `in` 11, `wildcard` 2	`exec`, `ProcessRollup2`, `exec_event`, `open`, `executed`
`event.type`	31	`eq` 28, `ne` 2, `in` 1	`start`, `change`, `deletion`, `process_started`
`EventID`	28	`eq` 28	`4688`, `4104`, `1`, `4663`, `10`
`Image`	25	`ends_with` 19, `starts_with` 3, `wildcard` 3, `eq` 1	`\findstr.exe`, `/dev/shm/`, `\find.exe`, `/.`, `/boot/`
`host.os.type`	25	`eq` 21, `in` 4
`process.args`	21	`in` 11, `eq` 9, `wildcard` 9, `contains` 5, `starts_with` 2, `ends_with` 1, `match` 1	`/bin/awk`, `/bin/cat`, `/bin/head`, `socat `, `--output`
`data_stream.dataset`	17	`eq` 17	`aws.cloudtrail`, `kubernetes.audit_logs`, `azure.activitylogs`, `auditd_manager.auditd`, `azure.signinlogs`
`OriginalFileName`	16	`eq` 16	`findstr.exe`, `find.exe`, `reg.exe`, `wevtutil.exe`, `wmic.exe`
`event.category`	13	`eq` 13	`process`, `file`, `network`
`TargetFilename`	12	`in` 5, `contains` 3, `ends_with` 3, `starts_with` 2, `eq` 1, `wildcard` 1	`.pfx`, `/etc/kubernetes/admin.conf`, `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`, `\\profiles\\outlook\\9375cff0413111d3b88a00104b2a6676`, `*\\windows messaging...`
`event.outcome`	11	`eq` 8, `in` 3	`success`, `Success`
`ScriptBlockText`	9	`contains` 6, `eq` 2, `in` 2	`export-certificate`, `export-pfxcertificate`, `-r`, `-pattern` , `.maxpasswordage`
`username`	9	`contains` 9, `ne` 1	`serviceaccount`, `kubelet-nodepool-bootstrap`

Top indicator values (2114 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticAttempted Private Key Access elasticAWS Credentials Searched For Inside A Container elasticCloud Credential Search Detected via Defend for Containers elasticCommand Shell Activity Started via RunDLL32 elasticCredential Access via TruffleHog Execution elasticGitHub Authentication Token Access via Node.js elasticKubeconfig File Discovery elasticKubelet Certificate File Access Detected via Defend for Containers elasticKubernetes Direct API Request via Curl or Wget elasticKubernetes Service Account Secret Access elasticMicrosoft IIS Connection Strings Decryption elasticMicrosoft IIS Service Account Password Dumped elasticPotential Impersonation Attempt via Kubectl elasticPotential Privilege Escalation via Linux DAC permissions elasticPotential Secret Scanning via Gitleaks elasticPrivate Key Searching Activity elasticSecurity File Access via Common Utilities elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Files Compression elasticSensitive Files Compression Inside A Container elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSensitive Keys Or Passwords Searched For Inside A Container elasticService Account Token or Certificate Read Detected via Defend for Containers elasticSuspicious CertUtil Commands elasticSuspicious Instance Metadata Service (IMDS) API Command Line Execution elasticWeb Server Exploitation Detected via Defend for Containers elasticWireless Credential Dumping using Netsh Command	27	606
`EventType`	`eq`	`exec` elasticAWS Credentials Searched For Inside A Container elasticCloud Credential Search Detected via Defend for Containers elasticKubeconfig File Discovery elasticKubelet Certificate File Access Detected via Defend for Containers elasticKubernetes Service Account Secret Access elasticPotential Privilege Escalation via Linux DAC permissions elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Files Compression Inside A Container elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSensitive Keys Or Passwords Searched For Inside A Container elasticService Account Token or Certificate Read Detected via Defend for Containers elasticWeb Server Exploitation Detected via Defend for Containers	12	171
`EventType`	`eq`	`open` elasticFirst Time Python Accessed Sensitive Credential Files elasticKubelet Certificate File Access Detected via Defend for Containers elasticService Account Token or Certificate Access Followed by Kubernetes API Request elasticService Account Token or Certificate Read Detected via Defend for Containers elasticUnusual Web Config File Access	5	15
`event.category`	`eq`	`process` elasticKubelet Certificate File Access Detected via Defend for Containers elasticKubernetes and Cloud Credential Path Access via Process Arguments elasticMulti-Cloud CLI Token and Credential Access Commands elasticPotential Credential Discovery via Recursive Grep elasticPotential PowerShell HackTool Script by Function Names elasticPotential Privilege Escalation via Linux DAC permissions elasticPowerShell Script with Password Policy Discovery Capabilities elasticSensitive Files Compression elasticService Account Token or Certificate Read Detected via Defend for Containers	9	128
`event.category`	`eq`	`file` elasticFirst Time Python Accessed Sensitive Credential Files elasticKubelet Certificate File Access Detected via Defend for Containers elasticSensitive Identity File Open by Suspicious Process via Auditd elasticService Account Token or Certificate Read Detected via Defend for Containers elasticUnusual Web Config File Access	5	31
`username`	`contains`	`serviceaccount` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Client Certificate Credential Created pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Secret Access Denied pantherKubernetes Secret Enumeration by a User pantherKubernetes Service Account Token Theft from Pod	9	24
`EventID`	`eq`	`4688` splunkADExplorer Execution (Windows Event Log) splunkADExplorer Snapshot Creation (Windows Event Log) splunkAttempted Veeam Database Credential Dump (Windows Event Log) splunkCredentials in Registry (Windows Event Log) splunkLocate Credentials (Windows Event Log) splunkMimikatz (Windows Event Log) splunkMimikatz Execution (Windows Event Log) kustoPowershell Empire Cmdlets Executed in Command Line	8	313
`EventID`	`eq`	`4104` splunkAttempted Veeam Database Credential Dump (PowerShell) splunkLocate Credentials (PowerShell) splunkWindows LAPS Password Gathering Via PowerShell Script splunkWindows PowerShell Export Certificate splunkWindows PowerShell Export PfxCertificate splunkWindows PowerSploit GPP Discovery	6	268
`OriginalFileName`	`eq`	`findstr.exe` sigmaAutomated Collection Command Prompt sigmaFindstr GPP Passwords sigmaInsensitive Subfolder Search Via Findstr.EXE sigmaLSASS Process Reconnaissance Via Findstr.EXE sigmaPermission Misconfiguration Reconnaissance Via Findstr.EXE sigmaPotential Password Reconnaissance Via Findstr.EXE sigmaPrivate Keys Reconnaissance Via CommandLine Tools sigmaRemote File Download Via Findstr.EXE	8	12
`event.outcome`	`eq`	`success` elasticAWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization elasticAWS EC2 Instance Console Login via Assumed Role elasticAWS EC2 User Data Retrieval for EC2 Instance elasticAWS IAM CompromisedKeyQuarantine Policy Attached to User elasticAWS IAM Long-Term Access Key First Seen from Source IP elasticAWS S3 Credential File Retrieved from Bucket elasticAzure Service Principal Sign-In Followed by Arc Cluster Credential Access elasticGenAI Process Accessing Sensitive Files	8	251
`EventType`	`in`	`exec` elasticGitHub Authentication Token Access via Node.js elasticKubernetes and Cloud Credential Path Access via Process Arguments elasticKubernetes Direct API Request via Curl or Wget elasticPotential Impersonation Attempt via Kubectl elasticPrivate Key Searching Activity elasticSecurity File Access via Common Utilities elasticSensitive Files Compression	7	171
`EventType`	`in`	`exec_event` elasticGitHub Authentication Token Access via Node.js elasticKubernetes Direct API Request via Curl or Wget elasticPotential Impersonation Attempt via Kubectl elasticPrivate Key Searching Activity elasticSecurity File Access via Common Utilities elasticSensitive Files Compression	6	139
`EventType`	`in`	`executed` elasticKubernetes and Cloud Credential Path Access via Process Arguments elasticKubernetes Direct API Request via Curl or Wget elasticPotential Impersonation Attempt via Kubectl elasticPrivate Key Searching Activity elasticSensitive Files Compression	5	88
`EventType`	`in`	`start` elasticKubernetes Direct API Request via Curl or Wget elasticPotential Impersonation Attempt via Kubectl elasticPrivate Key Searching Activity elasticSecurity File Access via Common Utilities elasticSensitive Files Compression	5	134
`process_name`	`in`	`bash` elasticCloud Credential Search Detected via Defend for Containers elasticGitHub Authentication Token Access via Node.js elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Identity File Open by Suspicious Process via Auditd elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSuspicious Instance Metadata Service (IMDS) API Command Line Execution elasticWeb Server Exploitation Detected via Defend for Containers	7	88
`process_name`	`in`	`dash` elasticCloud Credential Search Detected via Defend for Containers elasticGitHub Authentication Token Access via Node.js elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Identity File Open by Suspicious Process via Auditd elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSuspicious Instance Metadata Service (IMDS) API Command Line Execution elasticWeb Server Exploitation Detected via Defend for Containers	7	78
`process_name`	`in`	`fish` elasticCloud Credential Search Detected via Defend for Containers elasticGitHub Authentication Token Access via Node.js elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Identity File Open by Suspicious Process via Auditd elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSuspicious Instance Metadata Service (IMDS) API Command Line Execution elasticWeb Server Exploitation Detected via Defend for Containers	7	72
`process_name`	`in`	`ksh` elasticCloud Credential Search Detected via Defend for Containers elasticGitHub Authentication Token Access via Node.js elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Identity File Open by Suspicious Process via Auditd elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSuspicious Instance Metadata Service (IMDS) API Command Line Execution elasticWeb Server Exploitation Detected via Defend for Containers	7	73
`process_name`	`in`	`sh` elasticCloud Credential Search Detected via Defend for Containers elasticGitHub Authentication Token Access via Node.js elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Identity File Open by Suspicious Process via Auditd elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSuspicious Instance Metadata Service (IMDS) API Command Line Execution elasticWeb Server Exploitation Detected via Defend for Containers	7	83
`process_name`	`in`	`zsh` elasticCloud Credential Search Detected via Defend for Containers elasticGitHub Authentication Token Access via Node.js elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Identity File Open by Suspicious Process via Auditd elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSuspicious Instance Metadata Service (IMDS) API Command Line Execution elasticWeb Server Exploitation Detected via Defend for Containers	7	82
`process_name`	`in`	`cat` elasticAWS Credentials Searched For Inside A Container elasticCloud Credential Search Detected via Defend for Containers elasticKubelet Certificate File Access Detected via Defend for Containers elasticSecurity File Access via Common Utilities elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticService Account Token or Certificate Read Detected via Defend for Containers	6	23
`process_name`	`in`	`csh` elasticCloud Credential Search Detected via Defend for Containers elasticGitHub Authentication Token Access via Node.js elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSuspicious Instance Metadata Service (IMDS) API Command Line Execution elasticWeb Server Exploitation Detected via Defend for Containers	6	71
`process_name`	`in`	`tcsh` elasticCloud Credential Search Detected via Defend for Containers elasticGitHub Authentication Token Access via Node.js elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticSuspicious Instance Metadata Service (IMDS) API Command Line Execution elasticWeb Server Exploitation Detected via Defend for Containers	6	69
`container.id`	`wildcard`	`*` elasticCloud Credential Search Detected via Defend for Containers elasticKubelet Certificate File Access Detected via Defend for Containers elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticService Account Token or Certificate Access Followed by Kubernetes API Request elasticService Account Token or Certificate Read Detected via Defend for Containers	6	25
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS EC2 Instance Console Login via Assumed Role elasticAWS EC2 Unauthorized Admin Credential Fetch via Assumed Role elasticAWS EC2 User Data Retrieval for EC2 Instance elasticAWS IAM CompromisedKeyQuarantine Policy Attached to User elasticAWS IAM Long-Term Access Key First Seen from Source IP elasticAWS S3 Credential File Retrieved from Bucket	6	141
`data_stream.dataset`	`eq`	`kubernetes.audit_logs` elasticKubernetes Secret Access via Unusual User Agent elasticKubernetes Secret get or list from Node or Pod Service Account elasticKubernetes Secret get or list with Suspicious User Agent elasticKubernetes Service Account Token Created via TokenRequest API elasticService Account Token or Certificate Access Followed by Kubernetes API Request	5	36
`process.interactive`	`eq`	`true` elasticCloud Credential Search Detected via Defend for Containers elasticKubelet Certificate File Access Detected via Defend for Containers elasticSensitive File Compression Detected via Defend for Containers elasticSensitive Keys Or Passwords Search Detected via Defend for Containers elasticService Account Token or Certificate Access Followed by Kubernetes API Request elasticService Account Token or Certificate Read Detected via Defend for Containers	6	42
`Image`	`ends_with`	`\findstr.exe` sigmaFindstr GPP Passwords sigmaLSASS Process Reconnaissance Via Findstr.EXE sigmaPermission Misconfiguration Reconnaissance Via Findstr.EXE sigmaPotential Password Reconnaissance Via Findstr.EXE sigmaPrivate Keys Reconnaissance Via CommandLine Tools	5	12
`kubernetes.audit.objectRef.resource`	`eq`	`secrets` elasticKubernetes Rapid Secret GET Activity Against Multiple Objects elasticKubernetes Secret Access via Unusual User Agent elasticKubernetes Secret get or list from Node or Pod Service Account elasticKubernetes Secret get or list with Suspicious User Agent elasticKubernetes Secrets List Across Cluster or Sensitive Namespaces	5	6
`objectRef.resource`	`eq`	`secrets` sigmaKubernetes Secrets Enumeration splunkKubernetes Abuse of Secret by Unusual Location splunkKubernetes Abuse of Secret by Unusual User Agent splunkKubernetes Abuse of Secret by Unusual User Group splunkKubernetes Abuse of Secret by Unusual User Name	5	6

Exclusions (299 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`username`	`in`	`aksService` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Client Certificate Credential Created pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Secret Access Denied pantherKubernetes Secret Enumeration by a User pantherKubernetes Service Account Token Theft from Pod	9
`username`	`in`	`masterclient` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Client Certificate Credential Created pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Secret Access Denied pantherKubernetes Secret Enumeration by a User pantherKubernetes Service Account Token Theft from Pod	9
`username`	`starts_with`	`system:` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Client Certificate Credential Created pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Secret Access Denied pantherKubernetes Secret Enumeration by a User pantherKubernetes Service Account Token Theft from Pod	9
`responseStatus.code`	`ge`	`1` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Client Certificate Credential Created pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Service Account Token Theft from Pod	7
`responseStatus.code`	`ge`	`400` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Client Certificate Credential Created pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Service Account Token Theft from Pod	7
`responseStatus.code`	`le`	`16` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Client Certificate Credential Created pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Service Account Token Theft from Pod	7
`namespace`	`in`	`gke-system` pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Secret Access Denied pantherKubernetes Service Account Token Theft from Pod	5
`namespace`	`in`	`kube-node-lease` pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Secret Access Denied pantherKubernetes Service Account Token Theft from Pod	5
`namespace`	`in`	`kube-public` pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Secret Access Denied pantherKubernetes Service Account Token Theft from Pod	5
`namespace`	`in`	`kube-system` pantherKubernetes Data Copy via kubectl cp pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Secret Access Denied pantherKubernetes Service Account Token Theft from Pod	5
`verb`	`ne`	`create` pantherKubernetes Client Certificate Credential Created pantherKubernetes Ingress Created Without TLS pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes Service Account Token Theft from Pod	4
`ParentCommandLine`	`eq`	`runc init` elasticKubernetes Service Account Secret Access elasticPotential Privilege Escalation via Linux DAC permissions	2
`ScriptBlockText`	`eq`	`sentinelbreakpoints` elasticPotential PowerShell HackTool Script by Function Names elasticPowerShell Script with Password Policy Discovery Capabilities	2
`ScriptBlockText`	`eq`	`set-psbreakpoint` elasticPotential PowerShell HackTool Script by Function Names elasticPowerShell Script with Password Policy Discovery Capabilities	2
`kubernetes.audit.user.groups`	`eq`	`system:serviceaccounts:ibm-csi` elasticKubernetes Secret get or list from Node or Pod Service Account elasticKubernetes Secrets List Across Cluster or Sensitive Namespaces	2

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Unsecured Credentials `T1552`

Events covered

Authoring guide

Fields filtered most (185 distinct)

Top indicator values (2114 distinct)

Exclusions (299 distinct)

Rules under this technique

Sigma 52 rules

Elastic 72 rules

Splunk 44 rules

Kusto 15 rules

YARA-L 6 rules

Panther 30 rules

Keyboard shortcuts

Search operators

Unsecured Credentials T1552

Events covered

Authoring guide

Fields filtered most (185 distinct)

Top indicator values (2114 distinct)

Exclusions (299 distinct)

Rules under this technique

Sigma 52 rules

Elastic 72 rules

Splunk 44 rules

Kusto 15 rules

YARA-L 6 rules

Panther 30 rules

Unsecured Credentials `T1552`