Credentials in Registry
Subtechnique · ATTACK:enterprise:T1552.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1552.002",
"title": "Credentials in Registry",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1552/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--341e222a-a6e3-4f6f-b69c-831d792b1580",
"external_id": "T1552.002",
"domain": "enterprise",
"created": "2020-02-04T12:58:40.678Z",
"modified": "2026-05-12T15:12:00.624Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"credential-access"
],
"source_references": [
{
"source_name": "Pentestlab Stored Credentials",
"url": "https://pentestlab.blog/2017/04/19/stored-credentials/"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0075 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19e44b4d-fb66-43f9-8853-8e42692522b2
Pentestlab Stored CredentialsATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1eb94d47-7732-488e-b040-2bff5ab859a7
ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21454d73-1532-4656-9cd6-172f046613b3
ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--216b3711-fc70-4029-aaec-a8f021c38bef
Pentestlab Stored CredentialsATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--304f5c1b-7cfa-4c2a-b7a2-e4957da603b1
Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56faef01-6a5b-41a7-a7fe-888860750abe
CrowdStrike IceApple May 2022ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78c485fa-43f7-46b5-8f19-160fdec2f090
DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81cf1179-d422-44fd-9d3d-fadcc8ed2329
Check Point VOID MANTICORE Handala Hack March 2026ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91cff72f-644b-42e3-9c86-8cc6475f725a
TrendMicro Trickbot Feb 2019ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92c6a85d-d8b4-44d2-acf4-53ae07f69f77
SentinelOne Valak June 2020ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c4bd197-08a2-4ded-baba-bd70b6b4afd0
ATTACK:enterprise:T1552.002 → subtechnique-of → ATTACK:enterprise:T1552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adfeb8d8-1ce1-4abe-9861-21e2b26e8caa
ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4b8717c-a2bf-43af-b48f-8ef57bd6d36f
group-ib_redcurl1 · group-ib_redcurl2ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2ac3f65-68d3-45d2-8aab-b2bd57036fa8
SentinelLabs Agent Tesla Aug 2020