{'created': '2017-05-31T21:31:02.188Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may search local file systems and remote file '
                'shares for files containing passwords. These can be files '
                'created by users to store their own credentials, shared '
                'credential stores for a group of individuals, configuration '
                'files containing passwords for a system or service, or source '
                'code/binary files containing embedded passwords.\n'
                '\n'
                'It is possible to extract passwords from backups or saved '
                'virtual machines through [OS Credential '
                'Dumping](https://attack.mitre.org/techniques/T1003). '
                '(Citation: CG 2014) Passwords may also be obtained from Group '
                'Policy Preferences stored on the Windows Domain Controller. '
                '(Citation: SRD GPP)\n'
                '\n'
                'In cloud environments, authenticated user credentials are '
                'often stored in local configuration and credential files. In '
                'some cases, these files can be copied and reused on another '
                'machine or the contents can be read and then used to '
                'authenticate without needing to copy any files. (Citation: '
                'Specter Ops - Cloud Credential Storage)\n'
                '\n',
 'external_references': [{'external_id': 'T1081',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1081'},
                         {'external_id': 'CAPEC-639',
                          'source_name': 'capec',
                          'url': 'https://capec.mitre.org/data/definitions/639.html'},
                         {'description': 'CG. (2014, May 20). Mimikatz Against '
                                         'Virtual Machine Memory Part 1. '
                                         'Retrieved November 12, 2014.',
                          'source_name': 'CG 2014',
                          'url': 'http://carnal0wnage.attackresearch.com/2014/05/mimikatz-against-virtual-machine-memory.html'},
                         {'description': 'Security Research and Defense. '
                                         '(2014, May 13). MS14-025: An Update '
                                         'for Group Policy Preferences. '
                                         'Retrieved January 28, 2015.',
                          'source_name': 'SRD GPP',
                          'url': 'http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx'},
                         {'description': 'Maddalena, C.. (2018, September 12). '
                                         'Head in the Clouds. Retrieved '
                                         'October 4, 2019.',
                          'source_name': 'Specter Ops - Cloud Credential '
                                         'Storage',
                          'url': 'https://posts.specterops.io/head-in-the-clouds-bd038bb69e48'}],
 'id': 'attack-pattern--ba8e391f-14b5-496f-81f2-2d5ecd646c1c',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'credential-access'}],
 'modified': '2025-10-24T17:49:17.543Z',
 'name': 'Credentials in Files',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': True,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Microsoft Threat Intelligence Center (MSTIC)'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows', 'IaaS', 'Linux', 'macOS'],
 'x_mitre_version': '1.3'}