AN0860 Analytic 0860

IaaS · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Access to local credential/config files (e.g., ~/.aws/credentials) followed by metadata API calls or cloud role assumptions.</p>

Detects: T1552.001 Credentials In Files
Part of: DET0307 Detect Access to Unsecured Credential Files Across Platforms

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
CloudTrail:GetObject	`sensitive credential files in buckets or local image storage`	DC0055 File Access
AWS:CloudTrail	`command-line execution invoking credential enumeration`	DC0064 Command Execution
AWS:CloudTrail	`sudden role assumption after credential file access`	DC0067 Logon Session Creation

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`CredentialFilePattern`	Regex to match common credential files (e.g., *.aws/credentials, token.txt)
`RoleAssumptionScope`	Adjust scope of roles monitored (e.g., admin, service accounts)
`TimeWindow`	Correlation timing between file access and AssumeRole