#36223 [Huntress Detection] LOW - Incident on WLF-868CZ44 (Williams Law Firm, PC)

Host: WLF-868CZ44 - https://artichoke.huntress.io/org/53144/agents/12846104
Organization: Williams Law Firm, PC
Tags: None
Security Products: Windows Defender

Incident Report: https://artichoke.huntress.io/org/53144/infection_reports/1770241
Severity: Low

Investigative Summary:
----------------------
Huntress detected one or more files on this endpoint that may contain passwords. Having passwords readily available on disk or network shares does not follow security best-practices as threat actors often search for and exploit this data. To reduce organizational risk, we recommend you remove these files and consider the use of a secure password manager.
This message was sent out to ensure you are aware of this potential security risk on this host. We will not be able to verify removal of the password files. We did not collect/examine the file to verify that it contains passwords.

Given the existence of this file, we recommend that your users receive training on the risks of insecure password storage:

- If you already have a Huntress Security Awareness Training (SAT) subscription, you can assign the "Storing Passwords" and "Password Manager" episodes to all employees of the affected organization.
- If you don't have an SAT subscription yet, you can start a free trial for full access to all content. Alternatively, we've made the "Storing Passwords" episode available to you for free at https://mycurricula.com/limited-preview/gplK6A7B8ROq

Commands used to open files that may contain passwords:
User: shea
Command: "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\shea\OneDrive - WLF\Documents\shea\xOngoing\1Password.xlsx"

Remediation Instructions:
-------------------------
To mitigate against post-exploitation attacks and lateral movement, consider switching to a secure password management solution. Before deleting any local credential files, ensure they have been backed up in a secure, encrypted location.
There may be other password files located on disk in the same directory as the above processes seen on the host - this list is not exhaustive. Huntress has not manually downloaded the files to confirm they contain credentials; however, due to the naming, password content is likely and your team should consider investigating.
If a threat actor gains access to this host and discovers a password file (whether locally or on a shared drive), these credentials can be used to launch follow-on attacks against the organization or to laterally move across the network. Additionally, password storage in this manner may negatively impact audits for mandatory security standards in certain industries.

Lead Signal Information:
------------------------
Signal Name: Potential Unsecured Credentials In Files
Detected At: 2025-10-27 21:07:05 UTC
Start Time: 2025-10-27 20:59:19 UTC
Command: "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\shea\OneDrive - WLF\Documents\shea\xOngoing\1Password.xlsx"
Executable: C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Process ID: ee18b10a-b36b-11f0-8cdd-5cb26d43ccf8
Parent Process: C:\Windows\explorer.exe
User: shea

All investigated signals can be found in the Huntress Platform: https://artichoke.huntress.io/org/53144/infection_reports/1770241#signals-investigated-tab

-------------------------
Thanks again for trusting Huntress and please don't hesitate to reach out to [email protected] if you have any questions.