What MITRE ATT&CK T1552.004: Private Keys (Enterprise Tactic TA0006 - Credential Access) requires
MITRE ATT&CK T1552.004 (Private Keys) is an Enterprise Credential Access sub-technique of T1552 (Unsecured Credentials). Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Affected platforms: Linux, macOS, Windows, Network. MITRE-documented mitigations include M1027 Password Policies, M1022 Restrict File and Directory Permissions, M1047 Audit, M1041 Encrypt Sensitive Information. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-04, AC-05, AC-06, AC-16, AC-17, AC-18.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1552/004/
SHA-256 integrity: b1fccaebf74d2b8a9ed4df3fafe42754e89db55661daf3f8f26b354ab4ae38c9
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1552.004: Private Keys (https://attack.mitre.org/techniques/T1552/004/)
- MITRE ATT&CK Tactic TA0006: Credential Access (https://attack.mitre.org/tactics/TA0006/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access