> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials.md).

# Unsecured Credentials

**ATT\&CK ID:** [T1552](https://attack.mitre.org/techniques/T1552/)

**Description**

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Bash History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

## Sub Techniques

### T1552:001: Credentials in Files

{% content-ref url="/pages/UX9vQWzqR4LOhPJgr34x" %}
[Credentials In Files](/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/credentials-in-files.md)
{% endcontent-ref %}

### T1552:002: Credentials in Registry

{% content-ref url="/pages/I3jSkBv523oDEZxzirzt" %}
[Credentials in Registry](/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/credentials-in-registry.md)
{% endcontent-ref %}

### T1552:006: Group Policy preferences

{% content-ref url="/pages/IvtCq5tYASVrXqXRGZPY" %}
[Group Policy Preferences](/pentest-everything/everything/everything-active-directory/credential-access/unsecured-credentials/group-policy-preferences.md)
{% endcontent-ref %}