Potential Plaintext Credential File Creation

Tim Peck@timpeck

•updated Sep 15, 2025•2•0•175

Detects the creation or modification of files with names suggesting they contain plaintext credentials, such as passwords or recovery codes. This is a common tactic used by threat actors to find and steal credentials for lateral movement and privilege escalation.